I understand that for most users, the Envelope-from address is the most difficult part of an email to spoof because (I assume) it is checked by the receiving MTA i.e. if you attempt to spoof the "MAIL FROM" address the first MTA in the chain (normally your outbound SMTP provider) will reject it. This means the SPF check on the MAIL FROM will work as required.
However, if you are a spammer what is to stop you running your own MTA and putting whatever you like into the MAIL FROM header and therefore rendering SPF useless? You simply create an MTA that crafts the first envelope and pass it onto the next in the chain (the receiver's MTA)?
What have I missed here?