If you read the paper you will understand that they actually managed to forge what you call "the postmark" to fool the recipient server/software.

Email being a distributed system, the responsibility of identifying the sender is shared, and if implemented property works well.

The job of the client and recipient server is to verify the domain of the sender, according to rules defined by the sender.

The job of the sender server is to authentify the user account.

Implementing things properly is hard...