Lots of 'Help Desk' phishing messages not detected

We receive about 5 emails blasts per week of fake help desk emails asking our users to submit their credentials.  Each time I receive one, I add it as customer-specific spam.  The messages are very similar in nature (e.g. 'Your mailbox is running low on quota...') yet new spam always passes through undetected.  

The messages appear to be coming from legitimate users, whom I believe fell for the phishing attempt and had their address books harvested. 

Is anybody else having this problem? Have you come up with a viable solution? Any idea why SMG isn't catching these? Thanks!