"Nate Leon" observed:
I saw one vendor who claims to
have a sample, fraudulent message claiming to be from US Bank where the
IP address was spoofed.
These reports are achieving the status of Urban Myths.
When a report sounding very much like the one you reference was referred to the
experts on spf-discuss, and the purported log file (published as a flash
animation!) was analysed, they concluded that there was no evidence of IP
address spoofing, and that the people who had published the log and claimed
evidence of spoofing had made a number of elementary mistakes in their analysis
of the logged SMTP dialog.
Without direct, validated evidence I would discount all such reports. They
spread corrosive FUD.
Chris