[corresation]

have any experience of running very large and incredibly diverse networks like Oxford University's

The fact that they do something doesn't mean that they do it well. As others have mentioned, email filtering in Exchange (bizarre email platform for a university, but ignoring that) seems like a rudimentary starting point here.

[bat99]

Without wishing to debate the pros and cons of using Exchange, I can assure you that it was not the decision of the security team.