Legitimate use for spoofing: A call from outside the office comes into the company phone system and my extension is set to ring multiple phones simultaneously, some external to the phone system (e.g. mobile phone). I want the caller ID info coming into my mobile to be that of the original caller, not that of my phone system. If I couldn't spoof the caller's number, I would see the phone number of my office.