And based on Google's prioritization of AMP results in search, I wonder if they'll offer some sort of benefit to emails supporting AMP? If so, spammers will be the first ones on board.

Want to see some examples of the most fully configured SPF, DKIM, etc records? Look at spam. The big boys take advantage of it all.

It's AMP so you won't be able to run (your own) Javascript so that kind of thing shouldn't be possible.

Pretty sure AMP only let's you use whitelisted components, not arbitrary JavaScript.