Ok, last post for a while (hopefully).

When I receive an email alert, it always starts with:
"One or more alerts have fired, the first one for this batch at [time/date]."

If I have a threshold set to '3' does 'first one' refer to the time of the first occurance of the issue?

The date and time shown here is when the alert first fired - this corresponds to the time the alert fired, not the time of the first packet lost (so if you get alerted when 3 of 3 samples are over a threshhold, then the time will be when the 3rd sample hits, not the first).

Note that the "One or more" is listed because it's possible that the same alert may have gone of multiple times while Ping Plotter was holding on to email notification (if you have it set to wait before sending emails, or to only send every X minutes) - the time shown on the alert will be when the first one fired - not any subsequent events. Once the alert email goes out, this time is reset and it will be the first one that fires after the last email went out.

Note that some of this behavior may be slightly different in the 2.40 beta version - as the alert system was significantly rearchitected.