Is there anyway you could PM me from which email address the spam originated from so I can investigate on my side. When I look at the mail logs of the server, I don't see any abnormal activity.
Or perhaps send me a timestamp of when such an email hit a spamtrap, so I can have a closer look.
The system is being used by a conveyancing firm and they do have an app locally that relays mail through our server, where I think the spam could originate from.
For your assistance I thank you in advance.