Just to add another me too to the pile. I noticed them a few weeks ago and on looking at the details they were spoofing random addresses from everything at my domain name. As Jamie did, I switched the "all other email" addresses policy to dump them in the bin, rather than forward to my main address.

But, I am still regularly getting a bunch a day that are bounced spams "from me."

Let us know if the SPF works (and what it is, if it does).