It's possible to spend a BTC without fee to forge a payment?
The simplest protection is to not consider a payment to have been made to you until it receives some number of confirmations. The number can depend on the value of the payment. For small payments, one is probably sufficient. For large payments, some have decided to wait for as many as six confirmations.