On several occasions, outbound sales professionals sent themselves emails containing customer data. I've blocked sending archive attachments, but some people send multiple emails, each containing multiple attachments, and I have no way of detecting it before the fact.
Is there a way to use quarantine, e-mail compliance features, or other means of detecting when a user sends multiple e-mails to the same address over a short period.
User A sends N number of e-mails with attachments to the same recipient within T hours.
… and if that's the case, I'm alerted as an administrator, messages will quarantine once the threshold is reached or the user account is suspended (or whatever above).