I am just guessing, but O365 I cant remember its new name has been used by many businesses and I would expect the spammers are counting on business IT folks bei

I am just guessing, but O365 I cant remember its new name has been used by many businesses and I would expect the spammers are counting on business IT folks being lazy and just whitelisting o365's domains rather than custom per-company domain endpoints from O365. Meaning, sending from popular providers such as O365 or gmail is more likely to be whitelisted than one-off email provider domains. But I am just guessing. Another possibility could be that receivers of email from O365 may not see an easy way to report the spam to Microsoft or perhaps Microsoft do not have enough folks dedicated to dealing with UCE/malware reports. Just my own experience, but when talking to Microsoft about this topic they would refer me to a partner Proofpoint which a former company ended up using to front-end O365. That left me with the impression they did not want to be in the business of dealing with UCE/malware reports and wanted to either automate it or outsource to a partner.