1. A method for filtering messages, the method comprising: receiving a first electronic message via a network interface, the first electronic message including a first document file; extracting a first metadata dataset characterizing the first document file; retrieving a second metadata dataset from a database, the second metadata dataset characterizing a second document file included in a second electronic message; identifying that the first metadata dataset matches the second metadata dataset within a previously specified margin of error; and classifying the first electronic message as spam in response to the identification that the first metadata dataset matches the second metadata dataset within the previously specified margin of error.