VIP impersonation with charitable donation fraud

type.inbound
and strings.ilike(body.current_thread.text, "*charity*", "*gala*", "*donation*", "*donor*")
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "financial"
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "request"
)
and (
  any($org_vips, strings.icontains(body.html.inner_text, .display_name))
  or any($org_vips, strings.icontains(body.plain.raw, .display_name))
)
and (
  (
    (
      strings.istarts_with(subject.subject, "RE:")
      or strings.istarts_with(subject.subject, "FW:")
      or strings.istarts_with(subject.subject, "FWD:")
    )
    and (
      (length(headers.references) == 0 and headers.in_reply_to is null)
      or not any(headers.hops,
                 any(.fields, strings.ilike(.name, "In-Reply-To"))
      )
    )
  )
  // fake thread, but no indication in the subject line
  // current_thread pulls the recent thread, but the full body contains the fake "original" email
  or (
    not (
      (
        strings.istarts_with(subject.subject, "RE:")
        or strings.istarts_with(subject.subject, "FWD:")
      )
    )
    and 3 of (
      strings.icontains(body.html.display_text, "from:"),
      strings.icontains(body.html.display_text, "to:"),
      strings.icontains(body.html.display_text, "sent:"),
      strings.icontains(body.html.display_text, "subject:")
    )
    and (
      length(body.current_thread.text) + 100 < length(body.html.display_text)
    )
    // negating bouncebacks
    and not any(attachments,
                .content_type in ("message/delivery-status", "message/rfc822")
    )
  )
)
and (
  profile.by_sender().prevalence in ("new", "rare")
  or profile.by_sender().days_known > 30
)
and not profile.by_sender().any_false_positives