index=YOUR_EMAIL_INDEX sourcetype=YOUR_EMAIL_SOURCETYPE earliest=-7d latest=now
message_id="REPLACE_WITH_SOURCE_MESSAGE_ID"
| stats min(_time) as first_seen max(_time) as last_seen count
    values(src_user) as senders values(subject) as subjects
    values(action) as actions by message_id recipient
| sort 0 - last_seen
| head 500
| convert ctime(first_seen) ctime(last_seen)