It's because anyone can send email from any email address. SPF, DKIM and DMARC prevent impersonation on the domain level, but not the account level. Basically,

It's because anyone can send email from any email address. SPF, DKIM and DMARC prevent impersonation on the domain level, but not the account level. Basically, if you can send using you@domain.com, you can also send as someone_else@domain.com. Now, of course your sending SMTP service _should_ prevent this by means of authentication, but the receiver can't rely on this.