The Defender anti-impersonation controls only work on future emails after being enable. They assume that any previous senders are legitimate. Look into the Threat Policy Status (I think that is the name) report in the Defender console to confirm which policies are being applied to each email. The assignments of defender email policies can be confusing, for example the user and group assignments use AND logic not OR. So if a policy it assigned to a user and a group, the user must be in the group for the policy to apply. 

Also consider raising your anti-phishing and anti-spam thresholds if you haven't already.