I started checking SPF records on my mail server. All spam that makes it through the other checks also has correct SPF records. Presumably if spammers control DNS for a bunch of crappy domains they can dynamically add the zombie machines to the SPF records on the fly and just get on with their day. Very disheartening.