I both lothe this happening and also know that it is often because of an intended safety feature called gray listing.
Basically due to resources cost a lot of spam will only get sent once and real emails will get sent again in exactly this kind of way. So it is a very low bar to pass when the system puts a low but above zero spam risk rating on it.
Yes of course more targeted things like spear phishing try more than once and get past this but bulk market type junk often does get blocked this way.









Full engine swap? Makes it even more ridiculous if so but someone stupid enough to do this seems like the type.