Earlier quoted context omitted.
It seems like everything in the zone "spf.nssi.telus.com" resolves, regardless of further DNS labels. So yeah, I'd say every host with any IP is allowed to send mails as anything from telus.com. That's a bit unsettling.
They appear to have quitely fixed it.
1: https://twitter.com/TELUSsupport/status/988060048843657216