SPF-compliant phishing?

Daniel Taylor wrote:

> SPF does not validate users.
The current syntax allows SPF to validate the local part on the envelope
sender. So it can validate users. For example:

mxout                   A       192.168.1.2
@                       TXT     "v=spf1 exists:%{l}.%{i}.spf.%{o} -all"
John.192.168.1.2        A       127.0.0.2
Mary.192.168.1.2        A       127.0.0.2

Roger