The IP cannot be forged, the attacker can however use a proxy to connect to a mailserver and thus his IP won't be visible to you
I agree with el-half on this. I know from personal experience (no I'm not a spammer) you can send Anonymous e-mail if you use this method. Use an anonymous proxy server to surf then net find a system thats running smtp server (simple mail transfer protocol) on port 25. Use the telnet client to bring up a shell prompt on the remote system then issue smtp commands to the SMTP server to make spoof *e-mail*. This is Very simple. A simple google search proves this:

As far SMTP being secure. Nope not in my opionion. 70% of SMTP servers out there allows anonymous access to the SMTP server. Large security hole.