We've discovered over time that from time to time, Office365 gets confused in regards to the differentiation between an internal and external Email and will consider "External" an internal Email in the case of certain forwards. This happens regularly with MS Exchange Meeting forward notifications. So you need to add an exception to the hardening rule where you want to look for the header element X-MS-Exchange-MeetingForward-Message with the value of "forward".
See example below.
