Those are good questions.
Yes, I think it’s possible if they know the incoming email address and spoof the From address so that it matches the mailing lists address.
I want to say no, but I’m not 100% sure on this one. So, maybe. Please give it a try and let me know. It’s possible that it also requires spoofing the sender address.
It’s definitely sent to Discourse.