There's prob some trick that makes outlook believe the email was signed in a way that supercedes all other checks. Who knows what edgecase pajeets didn't think to check Edit: Microsoft prob hasn't patched it because the (((feds))) are currently using the exploit for psyops or it was a feature written for them in the first place