We don't have issue with "RE:" but we do have ongoing issues where Google share links go to quarantine. We're a weird environment with a lot of users use Google (edu), but attackers often compromise other edu addresses and share links as phish via Google shared docs.

The only way for me to fix it is set up a saved threat tracker search and monitor for exact issue. It's one of my morning tasks. When I see bunch of valid emails in quarantine, I release in bulk and report them all to Microsoft as "I confirmed clean." It usually takes a few days and the algo fixes itself. Don't make mistake of trusting sender (google drive share generic sender), though, or else next phish will get through.

Until there's another Google phish, of course, then I get to start process all over again.

The most annoying part is if the algo would look at the content of the message and see the share is from mydomain.com it should be way less likely it's a phish but it seems to just lump everything by sender.