Does the use of SPF/DKIM/DMARC, which is much more prolific now than it was in 2016, not safeguard against this to a good enough degree?
Any good email provider (for the user) will not allow other users to send from addresses that do not belong to them and any good email provider or receiving service (for the Discourse instance) should reject emails that fail origin validation.
Providers will exist that don’t validate the from address and/or don’t set up SPF/etc. records but if a user chooses to use an email provider who does nothing to protect against impersonation, it seems reasonable that they can be impersonated.