sp*m sender and spf issue

Hello one customer receive email from "false sender", where From indicate email and domain but is envelope from other (not auth) For domain (in the From) there is a valid spf, all check is fine. In the email header received we see: -0.0 SPF_PASS SPF: sender matches SPF record -0.0 SPF_HELO_PASS SPF: HELO matches SPF record record spf is: v=spf1 +a +mx +ip4:x.x.x.x ~all Any suggest? Thanks