On Windows these messages are created using SMB IPC and you'd think this would mean the "sender" (user and host) are authenticated, but nope, the sender name is just a string field that can be anything. You'd also think the host would be based on something like the client IP and a reverse DNS lookup, what with the whole Active Directory thing, but nope, it's also just a string field that can be anything. And with SMB IPC you'd think only some privileged component can invoke it, but nope, any user can send those message popup commands to any machine pretending to be anyone on any other machine. I did not make wise use of this knowledge back then.