When multiple files are attached, DLP blocks the files one at a time.

In mail.yahoo.com, the website does not try to continue the file uploads after the first file is blocked. Because there is no file upload operation performed by mail.yahoo.com, DLP does not scan other files. So, no incidents are generated. 

If the same files are attached one at a time in mail.yahoo.com, the DLP block operation works as expected. It also provides a separate incident for each file with its own evidence object.  

When Web Protection Rule is modified to Monitor instead of Block, an incident for each classified file is received. The classified file has its own evidence object.