Your original post said:

When new "events" are seen, an email is sent. ...

"An email is sent" implies one email per run of the script. Sending one summary email per run would likely remove the need to threshold or at least give you breathing room while you work on the problem.