I'm usually much more pro-google than most on HN, but this is quite bad. I understand it enables other features and a technical work-around that also keeps those features is difficult. But this is a disastrous user experience.

It reminds me of caller-id spoofing. Yes, there's a legitimate use case for it. But don't just throw security out the window to enable it, especially when there is a clear and obvious way to abuse it.