MUA, MTA and SPF

We are a regional ISP in the Pacific Northwest and have hundreds of DSL
customers.  We run Postfix on our mail servers and we have all of our DSL
IPs authorized to send mail without having to use MUA authentication.  For
those with email accounts with us and not on our network the MUA must
authenticate.  The problem comes with our network users that are not using
SMTP authentication.  If they do not authenticate, SPF keys in on the IP of
the MUA and gives an SPF error and consequently several customers have their
emails bounced.

I would think that SPF would key in on the IP of the MTA and not the MUA.
All of our MTAs are listed in our SPF RR.  My question then, is this an
error in SPF checks?  If not, is there some sort of "tweak" we are missing
in Postfix for authenticating our users within our IP address space short of
adding all of those IPs to our SPF record?  Or do we need to contact all of
our customers and tell them they must use SMTP authentication?

OK, that was three questions.  ;-)  I am hoping to get a hit on a "tweak" in
Postfix.

Jesus Duarte