No the ISP isn't right, because anybody can enter any From: address of their choosing in their MUA. Therefore it's trivial for a spammer to spoof his way out. The only real way is to look if the IP address of the sender is in the ISP's netblocks, this way the ISP can authenticate the user. That's what most ISPs I've used do.