The source of text messages is indeed easily spoofed. Most paid services enabling you to send SMS over the web allow you to set arbitrary sender IDs, so the cost of entry for spoofing is about $5.
It's not hard to imagine this leading to trouble as soon as you get into the crosshairs of some internet troll who managed to get your mobile number.
That said, I like the passcode idea. I know that caller ID is easily spoofed, and so I would imagine that the source ID for text messages can be spoofed as well. Requiring the passcode would prevent this sort of attack.