VIP impersonation: Invoice fraud with mobile device sign-off

type.inbound
and any(map(filter(body.previous_threads,
                   any($org_vips,
                       strings.icontains(..sender.display_name, .display_name)
                       or (
                         .email != ""
                         and strings.icontains(..sender.email.email, .email)
                       )
                   )
                   and (
                     strings.iends_with(.text, "sent from my iphone.")
                     or strings.iends_with(.text, "sent from my ipad.")
                   )
                   and (
                     any(ml.nlu_classifier(.text, subject=.subject.base).topics,
                         (
                           .name == "Financial Communications"
                           or .name == "Request to View Invoice"
                         )
                         and .confidence != "low"
                     )
                     or any(ml.nlu_classifier(.text, subject=.subject.base).tags,
                            (.name == "invoice" or .name == "payment")
                            and .confidence != "low"
                     )
                   )
            ),
            .sender.email.email
        ),
        . == ""
        or (
          not strings.icontains(sender.email.email, .)
          and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
                      strings.icontains(.email.email, ..)
          )
        )
)