It's not necessary to hack someone's email to send a message with that "from" address.
When you set up an email account, there's a space for you to type in your email address. You can type anything you want in that space--it's not checked or validated. So for example I could set up Mail.app to use an email provider, only where it says "your email address," I could type "william.gates@admin.microsoft.com" and that's what would show up in the From: field. I wouldn't need to get access to Bill Gates' email account to send email with his From: address.
