I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through. 

I understand you easily spoof sender address' in emails, but I'm wondering what the consequences of **not** having authentication on a SMTP server?

The glaring one I see is that someone could send mail as a staff member or exec through that employees *actual account* without any kind of spoofing - is this worse than spoofing itself? Or would spoofing get the same reqult and thus there is no point trying to secure the server?