In some messages that we are auditing, there is a few that include an URL pointing to a site that contains a malware, and this URL isn't listed in any Symantec filter, due to short time between email disclosure and admin action trying to block the sender.

If we have a option to remove any URL inside the email, or, send this kind email to quarantine queue, we will increasing the messaging security.