In my opinion, it is reasonable to expect them to either validate you own the domain you are sending from, or to handle misuse aggressively. Perhaps they paint

In my opinion, it is reasonable to expect them to either validate you own the domain you are sending from, or to handle misuse aggressively. Perhaps they painted themselves into a corner in their infrastructure design and lack good engineers to resolve this? They might not admit this.