A MikroTik botnet exploited weak SPF configurations, spoofing 20,000 domains to launch widespread malspam campaigns.