I don't mean this to sound harsh, but this is part of my day job, and to be honest I don't think you have the experience or scope necessary to pull something like this off successfully by yourself while achieving any sort of meaningful result.
DLP is a HUGE domain. You haven't even been given any clear direction in what it is you need to be catching which makes this all the more difficult. Stolen internal sales leads or books of business? PII? HIPAA? PCI? You might not pass an audit of the latter two rolling your own solution (talk to your auditor BEFORE you start development).
And neither of your triggers will catch anything but a rogue spambot running on your network. In my experience people that exfiltrate data know they're doing something bad and take at least ONE step to cover it up. They're also not going to suddenly start sending 100x more emails than they usually do. At best using a regex for socials or A/R numbers might catch some accidental cases of Outlook autocompleting the wrong address and the sender sending it without looking.
- How are you going to distinguish 16-digit card numbers from any other 16-digit sequence?
- You could catch them all, but who is reviewing these false positives? Is anybody? If you don't have the budget for a commercial solution, do you even have analysts that are going to review anything you find?
- Word documents. Are you capturing and/or reading through those?
- Text files or docs renamed as something else?
- Images. Are you performing OCR on all outbound images?
- Alternate data streams/stego?
- If I export cardholder information to a PDF and stick it in an encrypted zip file, would you catch that? What if I stuck that encrypted zip inside another encrypted rar? You'd have to decrypt at least one layer of zip/rar file and parse a PDF to catch it. You could block all binary attachments, but when they turn to an alternate channel to send it out another way, will you catch that?
- You want to catch social security numbers? How are you going to distinguish those from mistyped phone numbers? Is 273-555-1010 a phone number or a social? How about 123769931? The same regexes will catch either.
Keep in mind none of these cases involve a change in velocity or attachments, as you're proposing you'd look for. It's just one malicious email among many benign ones I'll send that day. Maybe yours is different but in my experience most people aren't dumb enough to just dump PII into the body of an email and send it; 90% of the time it's encapsulated in at least one other format (pdf, txt, doc, doc inside zip, zip inside rar, etc).
Your question specifically pertained to email, but you also need to consider people using Facebook messaging, Dropbox, USB sticks, etc. to exfiltrate data...otherwise you might as well not bother. Email is just one tiny vector.
Don't mean to dump on you, just pointing out some of my own experiences with this field in the hopes it spares you some headache. You have no idea what you're getting into if you have no budget for tooling. DLP is one of the few areas I truly believe commercial solutions can do far better than rolling your own.