[THE SHORT ANSWER]: If sending orders to brokers and banks in your company require authorization (only authorized employees can do that) then email address is not an authorization method.
Yes, it is very easy for someone else to pretend it is sending email from someone else. Using an SMTP client library you can very easily fake an email. See the following python code:
#!/usr/bin/python
import smtplib
from smtplib import SMTPException
sender = '[email protected]'
receivers = ['[email protected]']
message = """From: From Person <[email protected]>
To: To Person <[email protected]>
Subject: SMTP e-mail test
This is a test e-mail message.
"""
try:
smtpObj = smtplib.SMTP('localhost')
smtpObj.sendmail(sender, receivers, message)
print "Successfully sent email"
except SMTPException:
print "Error: unable to send email"
NOTE: You only need to install and run an SMTP server on you local machine. If you are not running an SMTP server on your local machine, you can use smtplib client to communicate with a remote SMTP server. Many remote SMTP server can be tricked into sending email messages from spoofed email.
There are some tools that can be used for detecting spoofed email address. But then these tools or detection techniques must be executed by the receivers which in your case I assume will be the brokers and banks. I do not think they will use these tools :).
