Thanks for the feedback -- Microsoft is spending a lot of effort and time on addressing any vulnerabilities that might be leveraged by malicious users. As it is a pretty hard process, it can time... :).
On your spoofing concerns, yes, it is likely that many items are spoofed. That is why I include this:
"...he/she will have some information in the email that you receive that will allow an actual respondent or unsuspecting clicker to reply or return some data."
The focus of this article is to find one of these "live" return paths, either a non-spoofed email address or domain name, and use that to block spam. In fact, there was another tool announced today which relies on this to work properly (surbl.org), by scanning the body of a message and finding/blocking web addresses used by spammers.
I will note your caveat, however, in that Administrators should not assume that the "from" address is the spammers.
Thanks again!