Hello Anne,
I hope that this tech-note may help:
http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117796-problemsolution-esa-00.html
This is a technote to assist with tagging possibly spoofed emails.
You can change the action to another action if you want it to be dropped or actions in some other manner.
Regards,
Matthew