A customer of ours recieved an email "from" one of the users there. But it wasn't actually sendt from him. Spf fails, and most of the users did not recieve the email. But for some reason, office spam filer failed to stop all of them, and let some through. There is noe difference in the email, and it's sendt at the exact same time. As you can se in the picture belov, there is a few with status "Delivered", even though most are stopped. I have romeved the domain and a Name for security reasons.
It really depends on the recipient's system and the actions configured there. Even with hard SPF configured, the system can choose to still accept messages that failed the SPF check. And there might be other factors in place, such as users whitelisting this address, etc.