Since Launchpad includes a Sender header to say the it's Launchpad sending the mail on behalf of the user in the body From, it's really not forgery. Also Mail From is not the user's address so I think that the current behavior (which may not be what it was when this bug was filed) is consistent with RFC 2821 and RFC 2822. It's also correct from an SPF (RFC 4408) and SenderID (RFC 4405 - 7, I think) perspective.
Since Launchpad includes a Sender header to say the it's Launchpad sending the mail on behalf of the user in the body From, it's really not forgery. Also Mail From is not the user's address so I think that the current behavior (which may not be what it was when this bug was filed) is consistent with RFC 2821 and RFC 2822. It's also correct from an SPF (RFC 4408) and SenderID (RFC 4405 - 7, I think) perspective.