A broadcast packet is, at the ethernet level, a packet with a specific bit set in the address which tells: "if you see this frame, have a look at it". Normally, a network interface will disregard frames unless the destination address is its own MAC address (an interface can be put into "promiscuous mode" to pick up all frames); but the "broadcast" bit makes the frame "interesting" for all network interfaces.
When the frame is not filtered out by the network interface, the frame contents are processed by the host system regardless of its ethernet source and destination addresses: the frame was received, and that's enough. If the frame contains an ARP reply, then the information contained in this reply ("the host with this IP address uses that ethernet address") is duly processed. It depends a bit on the operating system, though: Linux is known to disregard ARP replies which do not correspond to an ARP request which it sent not long before.
There is no authentication whatsoever in the ARP protocol; it is built on trust. Hence, it is vulnerable to active attacks such as yours.
Setting a static ARP table entry gives you some protection, but removes a bit of flexibility (if the gateway hardware is replaced, the ethernet address will change, and since the static entry takes precedence, your machine will refuse to talk to the replacement) and it is not a complete protection either: your packets may still be observed by the attacker, and he can still spoof fake packets, which can be enough to do a lot of harm.
As a network administrator, the best you can do is a combination of static routes (tedious, does not scale well) and watch/logging/reporting (maintain a table of IP / ethernet pairs, report every ARP reply which tries to change that). See this page for a list of possible defenses.
