It could be spoofed, but not from inside SL. Another land owner couldn't put the same URL on their plot.
They would set their url to a script that sends the request with the spoofed referer and then pipe the response back. But it sounds like they are using 3rd party libs so it's moot anyways.