During a threat hunt in Microsoft Defender XDR Advanced Hunting, you suspect a low-and-slow phishing campaign in which many external sender addresses share the same sending domain but each individual address sends only a handful of messages. You want a single KQL query against the EmailEvents table that surfaces sending domains with an unusually high number of distinct sender addresses over the last 7 days. Which query construct should you use?