[MM3-users] Authentication of posts to a Mailman installation

I have a suspect post that appears to be from a member but has a link to a potential scam site. I am not knowledgeable about spoofed addresses in the header; can a hacker simply put someone else's address somewhere in the header and have the message accepted if that address appears in the list of members?

Steve Brown, administrator of a small list.