you must be talking about corporate antispam rules. An ISP has to be much more lenient as the customer has decided that ISP delivers mail to them so unless it is a phish pharm or balatant spam is should be delivered to the in box on the off chance the customer wants it. If you dont think that is true put 10 geeks in a room and let them discuss mail from the edge and you will sure see a lot of disparate interests. SPF is implemeted broken in so many places it is almost useless to derive much reputation from that. Now you have legitimate hosters like hotmail business services that use large data centers world wide natted behind a few IP addresses that compound the problem. Corporate antispam is easy peasey. For a large ISP not so much as the false positive rate has to be kept low while still offering protection to its customers