I have thrown together a quick PS Script that should give you details of any mailbox that exceeds the limit for the last 24 hr period, Please feel free to suggest improvements
# Connect to EXOL
Connect-ExchangeOnline
# Define the threshold for unique recipients
$threshold = 2000
# Get the current date and time
$now = Get-Date
# Calculate the start and end date for the 24-hour period
$startDate = $now.AddDays(-1)
$endDate = $now
# Get all mailboxes
$mailboxes = Get-Mailbox -ResultSize Unlimited
# Iterate through each mailbox
foreach ($mailbox in $mailboxes) {
# Get the sent messages for the specified period
$sentMessages = Get-MessageTrace -SenderAddress $mailbox.PrimarySmtpAddress -StartDate $startDate -EndDate $endDate -PageSize 5000
# Count the unique recipients
$uniqueRecipients = $sentMessages.RecipientAddress | Select-Object -Unique
# Check if the number of unique recipients exceeds the threshold
if ($uniqueRecipients.Count -gt $threshold) {
Write-Host "Mailbox $($mailbox.PrimarySmtpAddress) has sent to $($uniqueRecipients.Count) unique recipients in the last 24 hours."
}
}