In addition to EOP, we also employ other tools to help ensure email that is delivered to the mailbox is safe. While EOP does the initial scan of incoming email, it is still possible for a message to get flagged prior to delivery and in those cases, you will get a notification of this message being blocked with a reason for why that happened. If a message is determined to be malicious, there is no method to release it to the mailbox. The original sender would need to mitigate the cause for the message to be flagged and then resend.