Microsoft's spam filter is fundamentally broken. It's been that way for decades. There's an entire cottage industry of snakeoil salesmen that want to sell in-line antispam gateways to bolt onto 365, and the worst part is that they have a very good reason to exist...