google apps – In GSUITE, how to detect a user sending multiple emails to the same recipient to detect the exfiltration of data?

On several occasions, outbound sales professionals sent themselves emails containing customer data. I've blocked sending archive attachments, but some people send multiple emails, each containing multiple attachments, and I have no way of detecting it before the fact.

Is there a way to use quarantine, e-mail compliance features, or other means of detecting when a user sends multiple e-mails to the same address over a short period.

For example,
User A sends N number of e-mails with attachments to the same recipient within T hours.

… and if that's the case, I'm alerted as an administrator, messages will quarantine once the threshold is reached or the user account is suspended (or whatever above).