This seems doable. Let's assume you create a lookup table called senders with fields "ip" and "email", where you may have multiple rows for the same IP Address since you could have multiple emails for each ip.
With that assumption, I think you could handle it two ways. One, you could get all of the events and then filter for the ones you want. Second, you could use a subsearch to help build a search that only got you the events you were after in the first place.
Examples, not really tested:
The first way. Find all of the events, get the email addresses for the ip in the event, and include events where the Sender isn't in that list
| lookup senders ip AS OriginalClientIp OUTPUT email
| where isnull(mvfind(email,Sender))
The second way, build the search condition from the lookup first, then run the search. This should resolve to something like:
index=myindex (OriginalClientIp=x.x.x.x AND NOT (Sender="email@example.com" Sender="firstname.lastname@example.org)) OR (OriginalClientIp=x.x.x.y AND NOT (Sender="email@example.com" Sender="firstname.lastname@example.org)) ....
Not sure if all of the parens/quotes are right, but the basic idea is here
| inputlookup senders
| eval email = "Sender=\"" . email . "\""
| stats values(email) as emails by ip
| eval emails = mvjoin(emails," OR ")
| eval conditions = "(OriginalClientIp=" . ip . " AND NOT (" . emails . "))"
| stats values(conditions) as conditions
| eval conditions = mvjoin(conditions, " OR ")
| return $conditions