Mimecast Held Message
"A message triggered content policies" or so they say
- Navigate to Message Center -> Message Centre -> Held Messages

- Go to the Held Queue and add a filter for the "Moderator" group

Select the email
Click "Message" then "Show message content

Check the message sender, subject, and content and decide if its a scam
Take the appropriate action (Release or Reject)
