The Quest coexistence rules exist to implement Address Rewriting messaging policy for accounts joined to Address Rewriting. There's another Quest coexistence rule (in addition to the ToCC rule) in the source tenant as well: the 'From' Quest coexistence rule.
If rewriting is still working with the ToCC rule disabled then that is indicating that the 'From' rule is what is doing the rewriting.
The "ToCC rule" role is to handle To and CC fields re-writing.
There is a confusing area here. If there is a mail:
---
FROM: ARS-enabled userA
TO/CC: external@mail.com; ARS-enabled userB and "FROM rule" is ON "ToCC rule" is OFF
---
The rewriting will still be applied to the whole email message (all fields) regardless of the "ToCC rule" state, because the "From rule" is ON (the FROM address still needs to be re-written so they all get rewritten) when the the mail is received from a member of group ARS.
Confusing scenario: "ToCC rule" is OFF, but To/CC field is still re-written.
