The legacy compatibility of the protocol has brought all the hacks on top of it for identity verification like SPF, DMARC, DKIM ...

Even with those, the amount of farmed accounts from a reputable platforms is still high, and it will go higher with the cheap AI targeting that will make the texts much more well crafted and spam filters much more aggressive.

My other conjecture is that the big mail providers would have enough data to catch the spammers based on a number of signals.