Anyone willing to spin up a mail server can do this. DKIM and SPF are only intended to establish the identity of the server. I don't know that there is any obligation on the part of someone running a mail server to police the "From:" address on an email in some specific way. Traditionally the "From:" address was considered informational. It generally represents the address that the sender considers "their" email address. A actual user identity is established by signing the email and is separate from the "From:" address.
Does mailbox.org even include the "From:" address in the DKIM signature?
Does mailbox.org even include the "From:" address in the DKIM signature?