That’s still true, I was explaining this at work to the sysadmin that they should be careful and they said our email addresses couldn’t be spoofed, so I demonstrated it with his address. Spooked him a bit.