Correct. When a user forwards an email from their client, they are creating a new email using their own account and its domain, and including the content of the forwarded message either in the body of their email, or as an attachment. This means that any DMARC evaluation will be based on the email domain of the account that is forwarding the email.
Yes, and the only DMARC method that will survive that type of forwarding is DKIM. If those are indeed emails being sent on your behalf, you will need to DKIM sign them if you want them to survive automated recipient forwarding.
