Email headers can be authenticated. It's one thing email gets right.