Hi Sven,
I'm afraid Igor is right, this is spam, this is email.
Where the confusion is arising is that the From address of an email is ignored where there is a different Return-Path . So the SPF lookups are made against the Return-Path (fraud@aexp.com) not the From address (your local...