That's the entire basis of Kerberoasting: request a ticket for a service's SPN, then crack the ticket offline using the service account's password as the key. SPNs must be unique across a forest - a ...