Wildcard configured emails allow spammers to deliver mail? (SPF: "softfail")

When you use the SoftFail qualifier (the ~) in an SPF mechanism, you indicate that a matching sender should be treated with suspicion, but not outright rejected.

The Fail qualifier (the -) on the other hand, encourages receiving MTAs to reject the SMTP transfer immediately with a 5.1.7 DSN.

So when you are using ~all in the end of your record, you are only partially preventing spammers from abusing your domain and your reputation.

Read more about how check_host() results should be treated according to the RFC Specification here: IETF RFC 4408 §2.5 "Interpreting the results"

In addition to what Mathias said (which is good), note that key word encourages in his second sentense: "The Fail qualifier... encourages receiving MTAs to reject the email".

I would also recommend looking into DMARC. Once you have SPF and DKIM records in place, which it sounds like you do, DMARC is a way for you to tell receiving mail servers what to do with email that fails both the SPF and DKIM test.

When an email fails those tests, AND a receiving MTA honors DMARC records, then you can control what they do with that email: Reject it outright, mark it as a spam, or deliver it.