This is actually very easy to do, and spammers are nearly always sending from spoofed addresses and domains. To help stop this, you should setup SPF records for her domauin and make sure SPF filters are in place on your server...and that skip spam check on local domains is NOT checked. DomainKeys could also help with this as well.