A bit like trusted SQL auth that is only available to MS I expect there is some secret sauce that means it knows a message is coming from outlook and therefore less likely to be a spam relay etc