Doesn't spoofing the IP portion of UDP require a compliant network provider? I thought most upstream links would look at a spoofed packet and say, "Hey... no."

Not that this makes it impossible, just more difficult.