You haven’t mentioned what email provider they’re using. That matters a lot. Not all providers have smart filter. No need to attribute to malice what can be explained by reason.