Astonishing, but perhaps not surprising.
As I understand ADS-B's current implementation, there is very little that can be done to verify that a ADS-B position report is coming from where it says it is. IIRC, UAT/978MHz signals are only served by omnidirectional antennas, so you would have to get some kind of signal strength from each receiver for each position report and compare them to attempt triangulation. I'm guessing this isn't done now, and isn't going to be done for quite a while because of the cost. It would be difficult to automate well, but not impossible.
It might be a bit different for 1090ES. You could try and get directional data by changing the secondary radar receiver system, but this would take work, and since secondary radar isn't going away soon - remember that the Mode C requirement doesn't go away when ADS-B becomes mandatory in 2020, so expect Mode C to be with us until at least 2025.
I suspect that the FAA is comparing ADS-B data with primary and secondary radar returns. That's great and all that, but that means you need to have coverage, which isn't universal.
But a better question is what happens if a ADS-B report gets flagged by these mystery algorithms? A request to discontinue ADS-B service? Do the controllers give you the Skywest 5912 "That's BS" treatment? Nastygram letter from the FAA? The John and Martha King felony stop treatment when you land? Nothing?
ADS-B appears to be as secure as WEP wireless, which is to say not really at all. People who say "trust us, its secure" don't understand security. As others here have mentioned, security comes not from obscurity, but from public scrutiny. If you want us to believe it is secure, show us. We know how secure, say, AES crypto is because the details are public. The same cannot be said of ADS-B.
ADS-B is a great idea. The FAA's implementation of it appears to have some serious safety and security concerns for GA as well as commercial ops. However, it's hard to know without details, and I'm not holding my breath for those.
TODR