Set a alert about mail forward

Hi all,

Today we a user has received many  bounce back mail is about 'Undeliverable: xxxxxxxxx' messages  

after we investigation and check Office365Alerts mail we found  a user account has hacked, and set a mail forward,  

i would like to know can the set the Alerts rule only for forward outside organization or the IP address out of office. because the system default Alerts mail include  UpdateInboxRules.