A lot of SMTP servers implementing SMTP AUTH will add an annotation "(Authenticated sender: localusername)" or similar, which will let you distinguish between different users of the same mail server, even when they spoof the From: header. Not sure if that's the solution Posterous is using, or how widespread it is, though.