What’s to stop a phishing email putting a “verified by IT anti-phishing software” line at the top of the email? People don’t pay attention to special verification flags when they are there, so they don’t see them when they’re missing.
You have ingress filters that strip the subject tag out of anything and only add it back if it is verified. It's really not that hard and the training is supposed to train people. Nothing is perfect, nor does it need to be with defense in depth.
