Also, people will set up their own mail servers and can then authenticate themselves and send as much crap as they like.
Yes, but not with your domain, not unless they also hack the DNS records for your domain (in which case you've got more important things than spam to worry about).
Half the problem with spamming is that they spoof email addresses.
I regularly get spam sent to me from my own email address (A debate on the level of stupidity required for a person to open an unknown email wondering if they really did send themselves it is best left for another time), if my domain was required to check in order to allow this mail through, I would never see it.