I don't have a good answer for stopping it given what you have tried thus far, but one can reduce the impact by distributing the outbound SMTP to different SNAT's, CIDR blocks, data-centers or even AS Numbers depending on how complicated of a setup one is willing to support. Every SNAT of course needs FCrDNS and all the additional CIDR blocks would need to be included in your existing SPF but that should reduce the threshold in effect.