Understanding TrustPath

[Mauricio Tavares]

	I want to use whitelist_from_rcvd, so I am trying to understand 
TrustPAth. If you had your MTA outside of your LAN (outside IP LANIP, 
internal subnet LANSUB) with its own public IP (say MAILIP), would you have

internal_networks = MAILIP LANIP LANSUB
trusted_networks = MAILIP LANIP LANSUB (+ other machines you have 
outside the LAN you trust)

Am I correct? What would stop someone from trying to fake the 
originating IP to fit the ones in the above list?