Workspace rule- display a message if an incident is forwarded to a specific address

Summary:

I am trying to create a Workspace rule that will display a message box if the incident is forwarded to a specific email.

The main reason is to solve/reduce the problem where an agent forwards an incident to one of our aliases that route back into OSC causing loops and ultimately being filtered/rejected.

I have the basic rule in place that says when an incident is forwarded, then display the message. But now I'd like to display the message ONLY if it is forwarded to an email from a list of addresses. I don't know how to capture the "forward to" address and then compare it to see if it is on a list of restricted email addresses. I've tried creating a custom menu field of all the restricted addresses and then doing some comparison to the "forward to" address. I believe that "forward to" info is captured in