https://www.calconnect.org/news/2019/01/18/calconnect-publis...
I first spoken on a panel about it more than a year earlier than that, along with some people from 1&1 who were very keen to see progress on at least defining the risks!
But it's hard to get attention on fixing things, even in the big players (maybe especially in the big players) until there's user impact.
It's also why, from the very first moment we added this feature in our system, the default in Fastmail has been "only auto-add if it's from somebody in my addressbook". And the "from somebody in my addressbook" test checks for DKIM or SPF alignment.
We also allow turning auto-add off of course, or restricting it only to senders in a particular named addressbook group.