Here's my 2 cents, both on the general and the specifc questions:
You are all describing the "spam filter life cycle" - all filters do a decent job at first, but then their performance declines over time.
Why is that? Because spammers use the same filters to test their spam blasts. They just keep trying and trying, until they get past the filter. This is why SpamAssassin and the rest of them are very erratic performance-wise. The same applies for commercial filters - if you can purchase it and install it in house, so can a spammer.
The solution is using a filtering solution which cannot be obtained by spammers. The only such solution is a managed spam service, where the technology, by definition, is not available on the open market, only the filtering service.
For example, one such provider is Electric Mail.
As for the specific problem of spoofing and IP filtering -
The more sophisticated managed spam solutions use the information gathered from all the spam that is going through them to obtain a real-time list of IPs from which spam originates. They analyze data at the protocol level, noting where messages originated from. Header information is taken into account, but is only a part of the decision making process.
Anyhow, this was a long one to type...
Oren
ofriedman < A T > electricmail = d o t = com
