Technically this behavior is correct. Only authenticated users can set 
a requester address different than their own. This is enforced in a 
deeper layer and thus independent from where the ticket data is coming 
from, be it the web form or some email message.
But from a user's standpoint this is indeed unintuitive, so we should 
try to implement one of the two solutions you proposed.

I'm working on a Whups install where tickets are requested by email.
I was able to create tickets, but as long as I don't set the default 
ticket owner either in $conf[mail][username] or with the 
--default-auth option of the whups-mail-filter script, the Requester 
identity (i.e. the From: address in the email) is lost.


I had a look at the code in whups/lib/Mail.php, and it assigns 
$info['user_email'] only in the two cases I mentioned before:

         if (empty($auth_user) && !empty($info['default_auth'])) {
             $auth_user = $info['default_auth'];
             if (!empty($from)) {
                 $info['user_email'] = $from;
             }
         }

         if (empty($auth_user) && !empty($conf['mail']['username'])) {
             $auth_user = $conf['mail']['username'];
             if (!empty($from)) {
                 $info['user_email'] = $from;
             }
         }

Is this a wanted behaviour, or a bug?
If a default owner has always to be specified, then I think the 
whups-mail-filter script should fail in its absence.
If the default owner is not strictly required, I think that the 
Requester information should be recorded, and not be lost (to the 
casual user, it's not even that clear the relationship between the 
owner, and the requester email address).