AIUI, the difference is that, at the moment the HFTs place the order, they have every intention of filling them. Just because they might change their mind a fraction of a second later and modify their orders isn't particularly relevant.

Whereas spoofing is placing orders that you don't have any intention of filling. The only point of the orders is to move the market, rather than to actually make trades. And that's the thing that's illegal.

Therein lies the rub. How can regulators or prosecutors discern after the fact that a canceled order was one you intended to have filled?