At it's base, SMTP is just a text based protocol with no real verification. Here's an example:
=== Trying g3.example.net:25...
=== Connected to g3.example.net.
<- 220 home.example.net ESMTP Exim 4.68 Thu, 07 May 2009 11:03:21 -0400
-> EHLO g3.example.net
<- 250-home.example.net Hello g3.example.net [192.168.0.4]
<- 250-SIZE 52428800
<- 250-AUTH CRAM-SHA1 CRAM-MD5 MSN
<- 250 HELP
-> MAIL FROM:<email@example.com>
<- 250 OK
-> RCPT TO:<firstname.lastname@example.org>
<- 250 Accepted
<- 354 Enter message, ending with "." on a line by itself
-> Date: Thu, 07 May 2009 11:03:21 -0400
-> To: email@example.com
-> From: firstname.lastname@example.org
-> Subject: test Thu, 07 May 2009 11:03:21 -0400
-> X-Mailer: swaks v20070921.0-dev jetmore.org/john/code/#swaks
-> This is a test mailing
<- 250 OK id=KJA4HL-0006M6-8T
<- 221 home.example.net closing connection
=== Connection closed with remote host.
The "MAIL FROM:" line defines the SMTP envelope sender, and the From: is defined in the message DATA. There are wasy to protect against this, but they are defined in the mail server logic, not in the protocol itself.
For instance, I, as a mail provide, may require a user to authenticate using a user@domain type username. Then my mail server might require that any mail they send have an envelope-sender and a From: header that match the user I authenticated as. Additional technologies like DKIM and SPF can help in this area also.