Comment by paste0x78

This actually just happened to me yesterday. The spammer actually added a SPF record for another host he apparently had control of.

Removing the bad SPF record and updating passwords fix it for me.

Still waiting on my web hosting provider to see if it was changed from my account with a valid login or if they were compromised in some way.