Levels of Spam

The level of spam you receive to your domain/email accounts will always vary.

Our antivirus and anti-spam system is constantly updated and normally block 95-98% of all spam. 
Most of this does not even appear in your Scanning Interface Statistics, due to our edge-filtering, which blocks most spam before it even gets to our server.

However, spammers change the format and content of their emails regularly. Even 2 emails that look similar to the human eye can have dramatically different structures.

Whenever new strains of spam appear, it can take a bit of time for the system to be able to reliably identify the emails and generate correct pattern matches. 
The scanning system will then block these emails, but spammers are already working on ways to create new emails that get past scanning systems.

We do not block emails by keyword or phrases generally, as this practice can then block legitimate emails for other users, and spammers always change phrases, by adding in extra spaces, full-stops, dashes, spelling etc, to give an almost infinite combination to write the same sentences.

With new spam being sent every day, you should regularly remind your employees and users that they should not click on links in emails they did not expect or do not recognise the sender.
Also, hover your mouse over a link and see is the actual link the same as being displayed, this can hint at a phishing attack. Lastly, never run any programs that are downloaded from email links unless you are sure of the origin of the file.