So after almost a full day of dealing with this, I have yet to find a solution that keeps my legitimate System Admin emails but deletes the spam ones. I did all the sender and recipient filtering and everything M$ could propose but my issue is, these are good email addresses that they are sending into. The spammers have verified some good email addresses at my company and are distributing them freely now.
My solution is to create a rule in Outlook on all the users PC just to delete the bad ones. Its not pretty but it works, and its easy enough to just email instructions on how to import a .rwz file I made. I have only tested it with one or two good system admin messages so this may need some tweaking but what Im finding right now thats working is these settings:
Apply this rule after the message arrives
with 'undeliverable' or 'undelivered mail' or 'delivery failed' or 'delivery failure' or 'failure notice' or 'returned mail' or 'notification (failure)' in the subject
move it to the Deleted Items folder
except if the message header contains
[email protected]
I hope this helps someone else but if someone knows of a better way I will be looking for a better solution to this issue.
Thanks.