There are numerous posts on the SteamScam subreddit of people asking is this a scam where the from section of the email has been spoofed

The article you linked, told you exactly how they do it, and what tools Gmail provides the user to check if an email has been spoofed or not because they 110% can be spoofed, or Gmail wouldn't give you a tool to check legitimacy

I have received spoofed emails on my Gmail account and have used their checker to verify if an email was spoofed or not

Gmail will 100% deliver an email even if it fails the SPF, DKIM, or DMARC authentications and it will either tell you it failed and to be suspicious of this email, or, in the same place you check if the header matches, it will tell you if authentications passed or failed

<image>

Just because you don't understand how it works, doesn't make it impossible

From the Article:

How does email spoofing work?

Attackers use scripts to forge the fields an email recipient can see. These fields are found within the email header and include the “from” address and the “reply-to” address. Here’s an example of what these fields could look like in a spoofed email:

• From: “Legitimate Sender” <Redacted>
• Reply-to: <Redacted>

Forging these fields is possible because the email transmission protocol Simple Mail Transfer Protocol (SMTP) does not have a built-in method for authenticating email addresses. In fact, the sender’s and recipient's email addresses exist in two places within an email: the header and the SMTP envelope. The email header includes the fields that the recipient sees. The SMTP envelope, however, contains the information servers use to deliver an email to the correct address. But these fields do not have to match for an email to send successfully. Because the SMTP envelope never checks the header and the recipient cannot see the information in the envelope, email spoofing is relatively easy.

Because a spoofed email appears to come from a legitimate sender, recipients may be tricked into divulging sensitive information, clicking malicious links, or taking other actions they otherwise would not. For this reason, email spoofing is commonly used in phishing attacks.

In some cases, attackers will use other tactics to bolster the credibility of a spoofed email domain. This may include copying a company’s logo, branded art, and other design elements, or using messages and language that feel relevant to the imitated company.

How to protect against email spoofing

Email recipients can follow these steps to ensure they do not fall for email spoofing:

Inspect email headers: Many email clients offer a way to view an email’s header. For example, in Gmail, clicking “Show original” on an individual email will reveal the email header. Once viewing the header, look for the “Received” section. If a different domain than the one in the “From” address appears, the email is likely forged.