[ShowalkKama]

> Modern-day MC is a bit out of my depth but are these bans enforced in a similar mechanism to online-mode checks? (which validates that the username attempting to connect to the server has authenticated against the Mojang login servers?)

yes

> More importantly could it be possible for a modified client or server to 'spoof' reports against an arbitrary user to 'frame' them? Disturbing possibilities here.

no