I have the questionable pleasure of experiencing a deluge of backscatter since the rise of the Festi botnet, and I must say that I find the lack of sanity checks on automated replies appalling. It is not a courtesy to autorespond to spam by sending the spam "back" to a person who didn't send it in the first place and gave you all the information you need to clearly and easily establish that fact (Domainkeys / SPF).
There is only one place for automatically sending a message back to the original sender, and that's before accepting the mail in the first place. The sender sends the address information first. Reject the email then and there and include your out of office information with the bounce. Once you've accepted the mail, don't autorespond.
I agree about companies needing to push SPF and the like more. Sure, it still can cause some headache supporting.. but it helps address the problem.
As for the second bit, you've got to be joking. First, putting the out of office in the bounceback does nothing to mitigate the issue. You're still receiving an email for each and every bounced email. Second, millions of people have email that is hosted through another company. They realistically cannot set up individual bouncebacks for every single customer.
