Hi!
In my eyes, nobody should dictate others "policies" for email. The domain
owner has this right, as he was the one who owns the domain and will be
liable for any email send using his domain that conforms to his own SPF
policies.
Passing the SPF test doesn't necessarily mean that a mail is not spam.
This just tell us that the owner of the domain allowed this mail to go
out. If we end up having huge amount of spam from this particular lax
policy, the domain *will* end up in a domain-blacklist and we will have
other measures to prevent if from happening again. Maybe this blacklisting
will bring make the original domain owner to rethink his policy.
But we as a receiver should not dictate what is a "valid" and an "invalid"
policy, this is called *sender* policy framework.
Cheers,
Ernesto