The top conversation showing in Netflow will always be the conversation that did the most in the time frame you are currently viewing.
In regards to your alerts, I would change them from 30 mins to 10 mins. So if bandwidth runs at 90% or more for a continuous 10 mins, then get alerted. This way you'll know about it to when it is possible that users could start complaining. 30 mins seems a long time.
In my bandwidth alert, I also include a link to the interface in question that shows the netflow stats. So whoever reads the emails, can quickly see what the traffic is by clicking on the link.
Thanks, I'll try it out for a week and tweek it as we go along.