SPF record is overly permissive
The SPF record uses a mechanism that allows any sender, such as +all.
Why it matters
Receivers are told that every host on the internet may send mail as this domain.
What to do
Replace +all with ~all while you test, then -all when the list of senders is complete.
Reference
SPF records specify which hosts may send mail for the domain.