Indeed, but unless Medium are actively involved in assisting the spoofers (Which makes no logical sense to me), I don't think any of it is their fault, though maybe they should adopt some more defensive anti-spoofing web technology, to at least make it a little more difficult for the spoofers.