> 1) Klez forges the envelope From too? (not just header From)
> 2) Klez will look up the MX for the forged From and attempt to send the
> mail through there?
Klez attempts to guess the MX to use based on email addresses it harvests
from your system.
Klez does not require a correctly configured email client to spread.