I'm happy it's cancelled. However, a fair amount of work took place globally to prepare for this. I'll share this KQL query that easily gives you the 24-hour rolling window count of sent messages by a mailbox (you can tinker with the filters to get it just right for your use case):
// see https://learn.microsoft.com/en-us/kusto/query/sliding-window-counts-plugin
let id = 'email address removed for privacy reasons'; // Sender, recipient, subject, etc. etc., that you're wondering about.
let start = ago(10d); // How far back to to inspect.
let end = now(); // Can be changed if up to present is not the desired time range to inspect.
let lookBackWindow = 24h; // Size of rolling window.
let sampleFrequency = 1h; // How often to measure the rolling window.
EmailEvents
// Put criteria for which emails to summarize below:
| where SenderFromAddress =~ id and Timestamp between (start .. end )
// leave the following line and modify only the left-most field (idColumn) as needed:
| evaluate sliding_window_counts(SenderFromAddress, Timestamp, start, end, lookBackWindow, sampleFrequency) | order by Timestamp desc
| extend Datetime_AST = datetime_utc_to_local(Timestamp, "Canada/Atlantic") | project Datetime_AST, Count
This is now a common query for all kinds of troubleshooting but I came up with it mostly due to this topic.