You don’t need a password. Posterous fail. 
It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened.It's ridiculously easy to forge email headers.  Headers are manually created whenever programmatically sending email messages.  That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com.  They don't even send a confirmation email that you have to approve before stuff is posted?