The spoofing stopped yesterday and then started again about an hour ago, despite having updated my SPF record.