Wacky SPF Policy

I was directed by a young whippersnapper at the pobox help desk to sign up on
the SPF mailing list to learn something about it.  He offered the comment that
pobox invented SPF (so there!).

I had complained to them about this mail stalling in my outbound server:

-----Q-ID----- --Size-- -Priority- ---Q-Time--- --------Sender/Recipient--------
s15Dbwo2018764      250    1290946+Feb  5 08:37 <[email protected]>
                 (Deferred: 453 Please see http://spf.pobox.com/[email protected]&ip=65.254.18.67)
						<[email protected]>
		 (Deferred: 453 Please see http://spf.pobox.com/[email protected]&ip=65.254.18.67)
s15DtnEW027481      501    1291256+Feb  5 08:55 <[email protected]>
                 (Deferred: 453 Please see http://spf.pobox.com/[email protected]&ip=65.254.18.67)
						<[email protected]>
		 (Deferred: 453 Please see http://spf.pobox.com/[email protected]&ip=65.254.18.67)
		Total requests: 2

I tried following the link, which failed at first due to their web server being
unresponsive, and I eventually got this:

"
rejected a message that claimed an envelope sender address of [email protected].
received a message from host-65-254-18-67.static.longislandfiberexchange.net
(65.254.18.67) that claimed an envelope sender address of [email protected].

However, the domain wpi.edu has declared using SPF that it does not send mail
through host-65-254-18-67.static.longislandfiberexchange.net
(65.254.18.67). That is why the message was rejected.

If you are [email protected]:
wpi.edu should have given you a way to send mail through an authorized server.
"

So, what appears to have happened here is that an infected pc in some home or
office in Long Island is running a mail bot which forged mail from my address.
Also, they tell me that my address should pass SPF.  In any case, the result is
that my address is now rejected by pobox, even though it comes from a server on
which it passes SPF.

I complained and was told I should learn about SPF, as I mentioned at the start
of this message.  Just to blow off steam, I'm posting to the list.

I set up SPF at WPI.EDU some years ago in hopes that @wpi.edu email from other
domains would be recognized as forged.  This appeared to be the purpose of SPF.

Perhaps, had I not set up SPF, I wouldn't have been blackballed by pobox this
way, since the email from that infected pc would not have failed SPF and
therefore my email address would not have been screwed this way.

This process that pobox follows seems to be monumentally twisted.

I would have thought they might do a few things:

1. blacklist the pc, since it issued violating email
2. dropped that message in the first place, since it violates spf.

Heck, I'd like to drop SPF-violating email at our domain, except I found that
so much email that people want to get does violate SPF.  All we do here is put
[SPF:Probably Forged] in the subject line.  That seems to annoy our recipients,
since they know that the message is from their colleague and there is "no way"
it could be forged.  Occasionally I remind them that if they see that mark on
email from the IRS, a bank or Amazon or Ebay or PayPal, they'd better pay
attention.

Anway, back to the pobox behavior, they don't do the things I would expect they
might do.  Instead, they black list the email address which violated SPF.  They
don't even relent when that message really is from a good SPF source.

This is astounding!

Is anybody aware of this?  Am I just overreacting?