That seemed to me like it might be an issue as well, as the "Destination Account" field is different between the two events (one with domain, one without). Would this not be possible to do then in this manner?
However, your first option sounds like it should deliver the results we are looking for. How would I go about getting the Domain Admins group pulled into LEM?