Unfortunately, there's next to nothing can be done about spoofing email headers at present. Domainkeys is probably the most promising solution, but until it ends up in the SMTP /MTA RFC's there's not much you can do about the bounces from spoofed headers or the spoofed email themselves. SPF tried, but the takeup has been (relatively) miniscule because it failed to deliver what it originally promised.