Keep in mind that there are a lot of domains out there without SPF records, there's really no lack of domains to abuse.

Not to mention all the websites that get hacked or the uber-cheap registrars.