As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods.myMethod.send). While this is a problem as anyone can call a SC, I understand that we can write SC in such a way that it responds only to a message coming from a given address. This way we can prevent any Ether or Token is not transferred to an attacker.
My question is, can an attacker send messages to a SC while masquerading an address (as there's no signature) that the SC is willing to accept? By doing so, can the attacker burn Ether of that account (as gas is consumed to execute SC)?
If so, any suggestions to prevent this.