Security?

Just examining the code - I cannot see anything anywhere that deals with public / private keys etc.
The way the code is written at the moment, would it not be possible for someone to maliciously spoof another persons identity and empty their balance?
It looks like the transaction system just lets you specify the from and to address explicitly and it accepts the transaction to the block assuming it gets mined, whether you had the right to spend the coins in the persons address or not.

Of course, I may be wrong - can someone direct me to where this exists or confirm if it is an issue?

Bitcoin from memory derives the public bitcoin addresses from the private keys - meaning only someone who has the private keys can sign transactions. (Basically like signing a cheque)