Microsoft To Do Flagged Email List has Created a New Attack Surface for Junk Email

Update: On January 29, I finally got a response directly from a support engineer on the To Do team! He acknowledged that the issue was being addressed and asked me to keep in touch with any updates. Since then, I'm happy to report that the To Do Flagged and Important smartlists have been SPAM free. The only exception was a temporary, regression on Feb 19 that was repatched within 24 hours.

Now we can enjoy SPAM free To Do smartlists. Note: Any junk mail that made its way into To Do before this issue was fixed will have to be removed manually.