"although I think 10000 is too big as a default. Loading 10,000 events and their payloads could be quite slow."

Here's the way I'm thinking about it...

If you have 10,000 events in your buffer then one of two things is going to happen:
 - it's a bit slow to deduplicate (if lookback=10,000)
 - you get bombarded by nearly 10,000 events in your email, if lookback is a small number (say 1000)

Neither case is ideal, but functionally the first case is clearly preferable. The performance issue should be resolved longer term by doing deduplication centrally using an indexed field.

fwiw i have an agent with 3000 events and it seems reasonably snappy still