Maybe they should also work on what their users are sending as well.

Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.

This stops disguising yourself as a legitimate service.

If they did that you’d decry censorship.

Allowing basically ~whatever, but proving the sender address is an obviously good approach to me.