Let me explain you the situation a bit..
There are two websites hosted in the same server, example1.com and example2.com. Suppose Example2 is hacked and the attacker writes a PHP function to send email using PHP mail function or sendmail and he is sending email with @example1.com domain addresses. SPF and DKIM records would identify outgoing mails from example2.com's script as legitimate because the SPF record points to the right server address, right?
Then.. Is it possible to stop a website hosted in your own private server sending emails (via PHP mail or sendmail) with other hosted domain's name ?