In reply to Karsten Iwen.

Karsten
By design of ESA, the SMTP-dialog closes before the content in the message is analyzed. This also applies to attachments. Making an exception to this is a major change. Doing so would benefit the lawyer's use case that you mentioned (a false positive). But for the vast majority of SPAM messages, we choose to drop the message without reply to the sender. We don't want to provide information back to the malicious sender. For the cases like that of the lawer's, we recommend ISQ notifications and use of Safe-list / Block-list.
Thank you,
Kevin