We should have been receiving emails from Sophos regarding an MTR incident, but we never did. I went into Email Gateway > Message Trace and looked for the email address on the dates expected and we can see entries for the missing emails that state:
'Last Status' > Deleted for firstname.lastname@example.org | 'Reason' > Customer block list
The only place I would assume this would be is the Allow / Block list Settings entry in Email Gateway, but in said portal there's no such entry for any email address/domain that we were expecting the email to come from (email@example.com). Curiously, the status suggesting it was 'Deleted for' as above would imply that it would only be deleted for that named person's mailbox, and yet there were a handful of us in the intended recipients.
Can someone please clarify for me what has happened here and how we can ensure this doesn't happen again?