The from address can be faked, but then due to SPF/DKIM it will likely be flagged as spam or not delivered.