Do I know anyone with some experience in recovering from SPAM attacks / email bombing? A client has had their email address, which they feel is important to keep using, leaked somewhere, and they are receiving hundreds of SPAM emails ever day.

We've talked about changing their email address or changing hosting platforms (for something with better SPAM protection-- currently using M365).

We have playing whack-a-mole in the Microsoft 365 mail rules, by adding some of the common phrases to rules and incrementing the SPAM score, etceteras, but this is getting complicated.

Questions: Is there something that can be added to M365 to increase its effectiveness? Is there another approach we should be considering?