It's on a par with using a forged From header over SMTP. You can send e-mail as pretty much anyone. (Though technologies like SPF are helping clamp down on this.)

"Joe jobbing" is when spammers use real e-mail addresses in their From headers so that that person gets the flak. In a round about way, this is the same for patches/commits :-)

He changed his git config so that user.email was david@loudthinking.com (The email DHH lists on GitHub). GitHub then automatically says "oh, this is by david@loudthinking.com, so let's put his avatar there and link to his profile as the author."

Changing the config is as simple as

    git config user.email "david@loudthinking.com"

And you can add a --global flag if you want that to be the default for all repos instead of just the one you're on.

Edit: There's also some way to do it with a --author= flag when you commit.

You have it correct. What you say in your second sentence is exactly the issue.

If this is "actually" a big issue or not is another question.