On a computer, it's possible to trick a server that you are using a different computer by masking MAC address.
Is there something like that for android? Rooted phones have full access. So I'd think it should be possible. I don't mean wi-fi mac address, I mean 4g/3g alternative to mac, I assume it's ESN.
If that is possible, than there is a security problem. Someone can pretend that they are using your phone. Of course, there is still Google account password but still, is this possible?