Not all machines which email travels through need to have public IP addresses; as few as none could do if it's an internal mail.

So no, they need not be spoofed, they could be genuine (but as these IP addresses are not globally unique, they are not helpful in tracing)

slarty