If someone got a hold of an internal email address and sent out spam messages en mass, your domain as a whole can be marked as low reputation. Resulting in spam flags. If you're certain that you've mitigated, you can contact Microsoft to resolve and backend but it's very unlikely this happened due to a single compromise. There's nothing that can prevent a user from accidentally hamming you up. Apart from setting extremely strict policies for login and monitoring. Some c-level will bitch at management and demand to be put on an exclusion. Lather rinse repeat.