The way the mail protocol works, there's no sanity check on addresses.
A mail server conversation basically goes like this.
Server: "Hello, I'm mail.sample.org"
Client: "Hello. I'm jyabura.example.com"
Server: "Okay, go on."
Client: "I have mail for user@sample.org"
Server: "Okay"
Client: "The mail is from so-and-so@kumadori.demonstration.com"
Server: "What do I care? I'm just passing it to user's mailbox! You can say whatever you want!"
You can send a mail with whatever "from" you want. Legitimate mail clients generally put a useful value in, but if you're a spambot, you may want to use something else. It's also sometimes useful to forge a "from" address, for example, if you're a website form-processing script, you might want the recipient to be able to reply directly to the email address supplied in the form.
As for security issues, you might also try another mail programme like Thunderbird; less popularity means less people trying to game exploits for it.