As a test set up a content filter rule looking for something simple inside an email. Send a message that violates the content filter rule to two separate users. Confirm that both users receive the message. Run a manual scan against the two users who were sent the message using the test content filter rule. Wait for the scan to complete. Notice that both mailboxes were scanned and found violations. Confirm this by looking in the quarantine and viewing messages that were sent to both users, however, one user can still open the message from their inbox.
Mail Security only has the capability to scan the mail store on the exchange mailbox server itself not on the outlook client. In this scenario the reason why the user's message did not get quarantined is because they are running outlook client in cached mode. In cached mode the outlook client only pulls down data from the mailbox server if they push the send/receive button. Until they push the button they are accessing mail stored locally on their workstation. If user switches over to active mode in outlook it will pull down the new information from the mail store and see that the message was actually quarantined.