What I am missing in your discussion is following question:
Should we add following to the specifications of SPF v2?
"If the mail has been forwarded (because there is a SUBMITTER parameter or
similar), then the SPF implementation MUST first examine the SPF record of
the originating domain, if known. Only if the result is not 'pass' and there
is no modifier "only=orig" (or similar), the SPF implementation MUST examine
the SPF record of the forwarder."
Or in other words: If the SPF implementations did that additional DNS
lookup, would that be too much overhead?
Note that this additional DNS lookup is required only if the mail has been
forwarded and the SPF record of the originating domain is not yet in the
cache.
Roger