In addition to the spam filters I was thinking of creating a mail flow rule based on the Reply-To address, which I don't think is inspected by the block list. (I may be wrong)
I could not figure out how to create rule that would inspect for something like "reply-to = user@mail.com".
Can anybody suggest how I might create this rule?
What exactly do you want to "inspect"? With transport rules you can only use "constant" values when comparing headers/addresses, you cannot dynamically reference another value such as the "From" address or similar. For more robust inspection, you will need a custom transport agent, and as those are not available with Office 365 you will need to redirect the mail flow to some other system first. Which brings problems on its own.
