FWIW, NOAA and it's parent Department of Commerce is one of the rare instances of a federal entity standardizing on Google G Suite rather than Microsoft Office 365. Folks there would be seeing this spam in Gmail instead of Outlook (unless they're using a 3rd party email client). Headlines about APTs breaching Microsoft have been common in recent years, but I haven't heard anything remotely similar about Google.
