well, spoofing email is a good, easy start. one "nice" thing about it is that it usually is not logged. So existance of the sent email is all the proof you need.
@TildalWave We deal with this stuff all day every day here :) We clean up much faster than many other SE sites due to well, practice. SO's trashcan my eye...