Correlation among features (e.g. doc length, punctuation, ... ) in classifying spam emails
First about the features i  think you could add some such as :

the time when the letter is received,
number of links in the email,
the whole structure (does it follow typical structure for email),
number of words that contains numbers in it,
what is the whole mood of the email (sales,threats,info,...-for this purpose you can use sentiment analysis),
number of attachments ,
type of attachments and so on.

After that try with feature selection (you could read more about it here). For the imbalance data you need to resample the data. I would:

add copies of spam emails(oversampling)
try to generate new spam email (smote)

You can read more here.
I hope my answer will give you some clarity.