We have a multi-tenant Exchange 2010 environment with Forefront Protection 2010. One specific tenant is getting quite a bit of spam. When checking forefront, it seems that no external mail coming in gets blocked for them, but internal mail does. This tenant is setup via a Windows 2012 Web Application proxy server, where we have another tenant as well. All others are on TMG, but will soon also move to the web proxy server as well.
I am not sure why this specific tenant seems to bypass the spam filter. Any help would be appreciated.