"A subscriber said a msg. posted to the list was a forgery, done using
 his ID.  Assuming this is the case (it's not that I don't believe
 him, but the suspicious could wonder if he really posted it and then
 said it was a forgery :-)  ), is it probable?
 
"I know it is possible, but can someone give me a rough indication
 of how much knowledge would be needed to do it?"
 
Depends upon your user's operating system and mail subsystem. In general,
it's not impossible.
 
"And is there anything I can tell the person to minimize the
 chances of it happening again?  He could set his sub. to conceal,
 but that lasts only until he posted a msg."
 
Analyzing the logs is the solution. Send mail to [log in to unmask],
and send a copy to [log in to unmask], where system.domain.nam
is the fully qualified domain address of your user.
 
If there's forgery, they need to know. If someone is alleging forgery
where it is not occurring ... again, they need to know.
 
-- richard
 
=====
-- richard childers		[log in to unmask]		1 415 506 2411
         oracle data center  --  unix systems & network administration
 
                    Klein flask for rent. Inquire within.