Does this include some kind of authentication mechanism? That is, is there anything that stops them 'stealing' and forging my (or your) address?

I think so, but I'm not certain. So far, I haven't seen this be a problem, so I think there's something in there that helps prevent this. Dunno what that would be, exactly, though. It does a lot of careful checking of the mail headers and the sending server, I just don't know exactly what.