[TCattitude]

I am still not understanding how the script would prevent someone with an email address on same domain and a fake header, from posting as someone else.

I would think that a better approach would be to issue a unique hash to each user on the forum and when the email is sent to them this hash must be somewhere in the email so that when users reply the software will authenthicate the user. Or something along the lines.

I will think about the same. That feature IS a must.

Maybe a new setting in usercp to put a new "email posting password", different from the login password (vb's password). Then a user MUST use that password in some part of the email, or in the very beginning of the email's subject in order to be able to post as that user.
So the system internally get that password from the email, validate it, and post the message if its valid. Discard it if its invalid (even log the "email post try", with the content and ip adress to check possible problematics users later).

I will use this mod if some type of security like that is added.
Great job anyways!