SPF doesn't prove that... I can send through SendGrid with an SPF record, doesn't mean I've got a server configured to receive mail... for that matter, it actually makes it so you HAVE to be responsible for the mail system and cannot outsource sending separately from receiving. Again, shifting the burden enough to where other measures of dealing with bad actors are more effective.