phishing & MS MUAs

MS MUA's hide the sender email address by default, so anyone is free
to do this:-

MAIL FROM: spammer(_at_)spf+cid-compliant-evilhost(_dot_)com
DATA
From: "updates(_at_)microsoft(_dot_)com" 
<spammer(_at_)spf+cid-compliant-evilhost(_dot_)com>

etc...

so CID, as it currently stands, is (IMHO) pointless - or am I missing
something?

Kind Regards,
Chris Drake