I understand this is not easy to do. My concern is the degree of
difficulty/expense it takes to do so. I saw one vendor who claims to
have a sample, fraudulent message claiming to be from US Bank
where the
IP address was spoofed.
It is a viable small scale attack, it is not a viable large scale
attack.
There are basically two types of IP spoofing, one is asymmetric
routing which requires the assistence of the IP address being
spoofed and is not relevant in the Sender-ID context.
The second method is various routing compromises. These are certainly
possible but unlikely to be persistent. Injecting fake routes for
IP blocks in use is not a very easy crime to get away with.