Yes. It is, to borrow the term, child's play to spoof a MAC address. So never key your security to this, but to a whole system key. For instance, hash a number of hardware signatures and the user's serial number for Windows. You get the idea.