FWIW, NOAA and it's parent Department of Commerce is one of the rare instances of a federal entity standardizing on Google G Suite rather than Microsoft Office 365. Folks there would be seeing this spam in Gmail instead of Outlook (unless they're using a 3rd party email client). Headlines about APTs breaching Microsoft have been common in recent years, but I haven't heard anything remotely similar about Google.

wait, isn't, like, everyone getting spam emails these days?

I definitely have hundreds of daily spam mails in my junk filter. So what is the actual point here?