Service Abuse: Zoom with freemail reply-to and recipient address in greeting

type.inbound
// is from zoom
and sender.email.email == "no-reply@zoom.us"
// has a freemail for a reply-to address
and headers.reply_to[0].email.domain.domain in $free_email_providers
// the reply-to address is new 
and beta.profile.by_reply_to().prevalence == "new"
and not beta.profile.by_reply_to().solicited
// the "greeting" line contains an email address matching the recipient's email root domain
// this is normally a name
and any(regex.iextract(body.current_thread.text,
                       '^\S+\s+(?P<last_word>\S+?),?(?:\n|\z)'
        ),
        strings.parse_email(.named_groups["last_word"]).domain.root_domain == recipients.to[0].email.domain.root_domain
)