2 ms·

I think in this case they are just spoofing the "From:" address, not the envelope address that SPF protects.