Re: Protection against forged IQ

Yes it's done this way. See ClientStanzaHandler.java:

@Override

    protected void processIQ(IQ packet) throws UnauthorizedException {

	// Overwrite the FROM attribute to avoid spoofing
	packet.setFrom(session.getAddress());
	super.processIQ(packet);
	}