When your organization sets up an email account in Microsoft 365, you're automatically given an onmicrosoft.com domain. But spammers are abusing the system, so Redmond is cracking down.