As i am working Symantec DLP,I feel ther should be some more feature that i mentioned below.
Symantec DLP should have on more feature by which we can add some public domains and if any user sends multple mail at same time or like 5-10 mails he sends on sigle time/ day . This scenirio should generate special alert. so that is easy to trace and handle it on pririty.
Thanks & Regards