Detecting Multiple Mailboxes Forwarding to the Same External Email Address

This query detects when three or more user mailboxes are configured to forward email to the same external email address.

Microsoft Sentinel (KQL)