I found and interesting page : http://wiki.apache.org/spamassassin/OtherTricks explaining that spam often use the first MX only to go faster, or only the last because the antispam system must be less efficient.

fake0.example.com   10
realmx.example.com  20
fake1.example.com   30

It also propose to add a lot of fake servers at the end, some spam machine use random MX.

fake0.example.com   10
realmx.example.com  20
fake1.example.com   30
fake2.example.com   40
fake3.example.com   50
fake4.example.com   60
fake5.example.com   70