Flag "echo" incoming transfers

[iamacook]

Description

We flag spoof events as imitation transactions. We don't, however, flag the other address poisoning vector whereby an attacker "echoes" an outgoing transfer with an incoming one of the same token.

We should flag the above transactions if they are under a certain limit.

Requirements

Flag incoming transfers that following outgoing transfers of the same token address, under a defined limit.

Additional information

No response