SPF and DKIM test the "Envelope-From" address that is part of the SMTP conversation, and separate from the "From" that is typically displayed in the message. I

SPF and DKIM test the "Envelope-From" address that is part of the SMTP conversation, and separate from the "From" that is typically displayed in the message. If you examine the full "Return-Path:" header you will see that it was not sent from your friends address after all. Everyone is receiving those (bogus) phishing emails.