I found and interesting page : http://wiki.apache.org/spamassassin/OtherTricks explaining that spam often use the first MX only to go faster, or only the last because the antispam system must be less efficient.
fake0.example.com 10 realmx.example.com 20 fake1.example.com 30
It also propose to add a lot of fake servers at the end, some spam machine use random MX.
fake0.example.com 10 realmx.example.com 20 fake1.example.com 30 fake2.example.com 40 fake3.example.com 50 fake4.example.com 60 fake5.example.com 70