Reading your question I am kinda thinking you are more refering to emails that have multiple recipients or say they go to distro groups which to split out the recipients you would use mvexpand recipient. Using that breaks each recipient out so it is its own event. So instead of seeing the one email with 50 recipients as one item it will be the 50 items your threash hold is looking for. I am using a query like this to do manual lookups for now going to build it into a coorelated search to so it will fire a notable event. To make it a higher fidelity rule you will want add some exclusions say your company has some sort of blast broadcast email address you would include something like src_user!=blast address or if you know you have multiple you may want to include a lookup table for your exclusions.
email query|mvexpand recipient|stats count(recipient) as recipients by Sender, Subject | where recipients > 10
... View more