What this tells you
Whether this person’s outgoing email volume for the day departed sharply from their own normal. A large or sustained spike can be worth a closer look, as unusual sending sometimes accompanies account misuse or bulk sending.
What this can’t tell you
It cannot confirm why the volume changed, whether it was legitimate (a busy day, a newsletter), or that any account is compromised. It measures change from the user’s own baseline, not intent.
How we describe it
Unusual outgoing email activity — this user sent significantly more (or fewer) emails than their normal pattern.