What SPF record are you using? A typical one would look something like
v=spf1 include:domain_or_ip include:other_domain_or_ip ~all
Which means that messages from the specified domains/IPs will be approved, and messages from everywhere else will soft fail, which means that it will be delivered but treated as being more likely to be spam. If you're having trouble with people sending emails from other IPs, you could upgrade the all paramter to a hardfail, so it becomes
-all. In theory, if your SPF record is correctly configured so it's being used by the receiving mail providers, they should reject the forged messages outright.