Because spam filtering is, ultimately, undesirable. It costs resources (processing power as well as setting up filters), it's never 100% correct, and no matter what you set it to, it will always block some emails you wanted, and allow others through that you did want.
In the real world, in most jurisdictions, spamming is already against the law (for various definitions and technicalities of "against the law"), but the problem is you can't really identify the source of most spam, so it's often impossible to stop the spammer from spamming you. Filtering spam is an incomplete, undesirable technical solution to a non-technical problem.
Withing an organization, this main reason for spam filtering doesn't exists. If an employee sends spam, you have lots of ways to act - have a stern talk with them, revoke their ability to send mail, ultimately fire them - which are the actions that should be taken instead of blocking email. Of course, the spammer might be powerful enough to not be bothered by those actions; but in that case, they're typically powerful enough to request their mails be removed from the spam list. (Arguably, this is the main reason why in many organizations, every employee needs to delete the weekly "information from the management" mail manually).
Of course, originating mail addresses can be faked, but a mail server can easily determine if the mail from firstname.lastname@example.org was sent from the internal network (in which case you can fire John, either for spamming or for not following account security policies), or from an external network (in which case the standard mail filter rules should apply).