It’s impossible for an email hygiene service like Exchange Online Protection (EOP) to suppress every possible piece of malware that attempts to penetrate Office 365. Even the broad array of anti-malware techniques will let some small percentage of spam through. Email administrators need to be on guard all the time.