Ya...unless you can get the ISP to send over MD5 hashed copies of the sendmail log (or similar) emails are incredibly easy to fake.