This might be a bug introduced while working on JAXWS 2.2 impl in CXF, so we should come to a jira to create at Apache.
Let's clarify the situation a bit first then: it seems to me the problem here is that cxf does not consider the action provided in the message, which is what you'd expect, right?
CXF instead goes throught the model constructed from the wsdl and try to get the action from that. That's why it's looking at the soap binding part of ws-addressing (http://www.w3.org/TR/ws-addr-wsdl/), which defines namespace http://www.w3.org/2006/05/addressing/wsdl for the Action element.