You don’t need a password. Posterous fail. 
<i>It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened.</i><p>It's ridiculously easy to forge email headers.  Headers are manually created whenever programmatically sending email messages.  That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com.  They don't even send a confirmation email that you have to approve before stuff is posted?