The likely design fault here is the key is the same for every O365/exchange online client (if they are using MS as their outbound transport). It should be unique so every client could have their own reputation.