It doesn’t prevent spoofing of the From header. But the reply key is like a secret that is only known by Discourse and you.
Every email sent by Discourse uses a different key. So, unless someone gains access to your emails or you forward the key to someone, nobody should be able to send an email to Discourse and successfully pretend to be you.