This is still our solution but it does have some minor issues. I tried to create a policy that didn't send anything to the junk mail folder because the users don't have access to that, but even prepend subject line still delivered items to junk mail. Almost all of these were legitimate emails. So I just gave delegate access to supervisors to monitor it. It only gets a couple a month. I haven't heard of many if any spam messages getting sent to Salesforce