This scenario describes a situation where you have blocked the sender under Anti-spam. However, The sender's emails are still delivered to your users mailbox.
Email Security.cloud
This Issue occurs when you allow your users to release quarantined emails if the blocked sender's action is set to Quarantine as shown below :
or if you have previously allowed to whitelist the sender which bypass the block level.
1- The Administrators can review the action Anti-spam Use blocked senders list (domains and email addresses only) and change it to Block and Delete rather than to Quarantine. Example :
2- Review any Whitelisting entry for the sender's domain or Email at global level or custom.
See more information about Approved senders and blocked senders lists : https://knowledge.broadcom.com/external/article/161464/approved-senders-and-blocked-senders-lis.html