Well if you get an email from [email protected] and the SPF and DKIM check out then it means that the mail really came from somemail and they have had the chance to verify that xxx is authorized to send the email with e.g. a password. The system is not 100% foolproof but it's good enough when working with reputable or selfhosted email services. It's way, way better than "anyone can trivially pretend to be anyone"