Can user.name be spoofed

Yes this value can be 'spoofed' and cannot be relied upon if the user is free to start the application.

Simply starting the app with the JVM arg -Duser.name=someothername will cause System.getProperty("user.name") to return that value.