Reply to post:

"ability to forge a From: address is baked in to SMTP, and it relied on Damian having sysop privileges."

You don't need sysop privileges to forge SMTP. You don't even need to be the janitor.