One of the big reasons to move to something like SPF is to make it a lot harder for worm forgeries to propagate. If merlyn used SPF (possible, I haven't checked) and you pay attention to SPF records if present (unlikely at present), then that worm would have been automatically blocked. Along with any spam that tries to claim to be from merlyn@stonehenge.com.

Right now the benefit to taking that step (either for you or merlyn) is pretty small. But it is a cheap step to take, and hopefully the value proposition will improve rapidly.