A bug discovered in the structure of Gmail's "From:" header could display a different email address as the sender's address than the real one. While this technique is quite high-level and can be exploited in a few cases, there are other cases that can be exploited to create confusion.
The discovery was made by developer Tim Cotton when a client of his found emails in her inbox that she didn't remember sending. A quick check revealed that the emails (found in the sent emails folder) had not been sent from her account. Instead, the emails had been sent to her account from another address, and the From: header had been changed. What was noticed was that the email was automatically moved to the sent emails, even though they were never sent from that account.
"The reason why with this particular technique the emails are automatically transferred to the sent emails is because the From header contains the address of the recipient as well as the sender. Gmail probably considers it to be some additional filter, and so it filters it automatically.".
However, there is a way to detect this technique. Initially, if an email client (such as Outlook or Thunderbird) is open, a notification will appear that a new email has arrived. Later, after it is automatically moved to the sent emails, the sent folder will appear in bold font, as the new email will not have been read.
Finally, Tim believes there are many ways to exploit this vulnerability. Theoretically, anyone could send an email pretending to be someone else, and the recipient would likely not realize it. One example is that anyone could use this bug to impersonate Paypal, a bank, or even the company the victim works for.
