Brad Rubenstein “:verified:” [OLD ACCOUNT] on Nostr: Somewhat more clever. The message is an unmodified message from Paypal to the spammer ...

Somewhat more clever. The message is an unmodified message from Paypal to the spammer as recipient. So the DKIM detects no tampering. Then the mail is given a new envelope sender and resent to the victim. These pass SPF. So the indicator of spam is not DKIM or SPF, but that the header recipient does not match the envelope recipient. A weaker signal.