For the most part, sender spoofing always worked in e-mail. It seems with increased roll-out of DMARC/DKIM this became less known?

It is an interesting bypass though.