I've had a number of instances where departing sales professionals have sent themselves emails with client data. I have blocked the sending of archive attachments, but some people will send multiple emails, each with multiple attachments, and I have no way of detecting it until after the fact.
Is there any way to either use the Quarantine, the Email Compliance functions, or something else to detect when a user is sending multiple emails to the same address in a short period.
For example, User A sends N number of emails with attachments to the same recipient within a period of T hours.
...and if so, then either I'm alerted as the administrator or the messages end up in quarantine once the threshold is met, or the user account is suspended (or all of the above).