Right now the "Send Email" action accepts an input "From" under the "More Options" and this could be misused for email spoofing. This is how the SMTP works however there should be an option to restrict the visibility of this input or should be given to only system administrators.