There are a lot of sites like that out there. Most don't check the validity of the "senders" address. The first time I spoofed one to a cousin who's also in IT, he nearly peed his pants. It was from "firstname.lastname@example.org"
Actually though, tracing spoofed emails is no big deal. Most people don't look at the headers, but most of what you need to trace located there.