We check email headers and have a few other factors to determine if the sender is genuine or spoofed. You would be able to create a new task list with a spoofed address, but you can't spoof your address to add to someone else's list.