spf and mail loops

It's a great day for slightly unusual mail questions:

1. SPF
My employer has an SPF record in DNS. A third-party marketer working with a department has been setting the from address to my user's addresses. Some mail servers are actually using our SPF record and bouncing the mail back to the falsified from address. The third-party vendor is now asking me to add their IP to our SPF record. If their goal is for recipients to reply to my users, then they should use the reply-to field. I say "no".

2. Mail Loops
My mailer-daemon sent a user a mail loop: too many hops (too many 'Received:' header fields) failure notice. I sent explanations ranging from friendly to medium to rigorous.