When ProtonMail's mail handler gets an email from mail.foo.com it's not coming in encrypted with the user's ProtonMail key. They have full access to the content

When ProtonMail's mail handler gets an email from mail.foo.com it's not coming in encrypted with the user's ProtonMail key. They have full access to the contents at that point and simple things like spam assassin would work, along with the usual DKIM/SPF checks. This is for external mail only though. Presumably they don't have a bad problem with internal users sending mail to other internal users. I'm guessing any that did would get found quickly via reporting or heuristics.