Simple-minded email question.

Hi.

Being somewhat simple-minded, I find the situation I encountered this morning very confusing.

First, I need to say that when I receive an email message purporting to be from Chase, AMEX, Bank of America etc, etc but which is clearly intended to phish for account credentials, I forward it on to the abuse team at the apparent source, so they can take steps to stop this activity, such as getting the IP addresses used by the actual senders disabled so potential victims can be protected from their actions.  I view this in the same was as picking up litter on the sidewalk, just being a good citizen.  I hope other people are doing similar things that might protect me from potential attacks that I might not recognize in time.

Today, I got a real beauty of a phish, purporting to be from AIG.  I first attempted to forward it to them.  This failed with a message from Cox, the nice folks who delivered it to my email inbox in the first place, that I was attempting to send spam and this action could not  be permitted.  Then, I turned the message into a text file, and attempted to send that to the abuse team at AIG as an attachment.   Again, my attempt to deliver potential spam was denied by Cox.

Finally, I zipped the text file, and sent that as an attachment, along with an apology.  It really is important to give the abuse team a sample that is as close as possible to the original content.

Here's my simple-minded question:  If this message is unwelcome and potentially dangerous, why was it delivered to me (and no doubt thousands of other Cox email users) in the first place? 

First, I refuse to believe that every email addressed to my inbox is delivered - the last statistic I saw about the volume of spam email on the internet placed it above 90%, and I expect that Cox is filtering out a lot of absolute ** prior to delivery.  Second, does this mean that Cox places a higher level of scrutiny on outgoing mail that incomming mail?  If the filters were symmetric, I should have been able to forward or attach the original message.

I really would like to understand this, and from where I sit it just does not make sense.