We scan for malware in messages that are sent to or sent from a mailbox (messages in transit). For Exchange Online mailboxes, we also have zero-hour auto purge (ZAP) for malware to scan messages that have already been delivered. If you resend a message from a mailbox, then it's scanned again (because it's in transit).