MS Outlook address spoofing

Hey dudes,

I want ask whether or not a malicious user can spoof a user’s email address (user@company.co.uk), sent emails with attachments and in someway to receive the emails that the recipient has replied with. The server is MS Exchange 5.5 and the clinet is MS Outlook 2002