A customer uses Salesforce email-to-case feature, which is receiving tons of spam via Exchange Online.
Salesforce recommends implementing the email-to-case feature by auto-forwarding emails from a 'published' mailbox (e.g., help@contoso.com) to an 'obscure' email address that Salesforce creates in the customer's SalesForce instance. (The Salesforce email address obscured - it's includes a long string of random characters to make it difficult to guess, and no messages are sent from it. Also one can change the Salesforce address in case it's ever published.) Salesforce opens or updates a case based on the 'from' address and/or finding a case number in the subject or body. The customer deals with all messages sent to help@constoso.com in Salesforce, not in Outlook.
As recommended by Salesforce, the customer has implemented auto-forwarding on the help@contoso.com mailbox to send everything it receives to the Salesforce email address that is hosted by Salesforce. About half of email sent to help@constoso.com is spam - not a surprise since they publish the email address on their website.
Problem: Exchange auto-forwards messages *before* they go through the spam filter (or any other filter other than DBEB, as far as I can see.) The help@contoso.com mailbox is pretty clean when accessed through Outlook, but Salesforce is receiving tons of spam.
I have some ideas on how to address this by checking headers set by EOP outbound spam protection in a transport rule applied to outgoing messages to the salesforce address. But in the name of getting rid of spam more easily, there should be an option for auto-forwarding to NOT forward messages that are directed to Quarantine or Junk by EOP or ATP. IOW, we should have the option to auto-forward only messages that end up in the Inbox. (Maybe there is such an option, and I've missed it.) After all, the customer is paying for an EOP license on this mailbox (and they are willing to buy an ATP license for the mailbox, if it would do them any good - which currently, it won't.)
Before migrating to Exchange Online, the customer passed all messages through a third-party spam/malware filter before sending them to Exchange on-prem, and they did not have this problem.
