In reply to Andrei Chira.

I tested this and still the problem exists (WP-Mail-SMTP). I think however it's not so easy to exploit when using it. This is because the only thing you can fake here is the 'received' domain in the mail headers. The return-path and other headers are set by the smtp plugin / provider.

It's something that should be fixed a long time ago though.