I just got this email from Posterous:

  ATTENTION: We noticed you're sending this from a different
  computer or location, so it won't get posted until we're 
  sure it's you. Please confirm that you sent this.

So, it looks like they've thought about this problem already.

But what action did they ask you to take to confirm that it is you?

Oh, good question - there is a link in the email to confirm that I want it posted. There is also a dashboard that lets me see all of the attempts and either approve or delete them.

OK. Easy enough: email spoofing + ip spoofing.

My welcome email from July 2008 has a prominent box that says, "Setting a password for your account is easy. It's optional, but here's why you should..."

What did you welcome email say?

Yep, my welcome email has the same box suggesting I add a password.

I think they're going to end up just as safe as every other blogging service out there.

I see two posts already.

Sorry about that; that was a mistake I made when creating the blog. I sent an email prior to creating an account - the system was smart and merged them.

I've removed the extra one, so it should be back down to one.