1. A method comprising: receiving a first email message from a simple mail transfer protocol server, the first email message comprising displaying characters and non-displaying characters, the non-displaying characters including non-displaying comments and non-displaying control characters; the first email message further comprising: a 32-bit string indicative of a length of the first email message; a text body; a simple mail transfer protocol email address that includes a user name and a domain name; an attachment; searching for the non-displaying characters in the first email message; removing the non-displaying characters, including the non-displaying comments and the non-displaying control characters; determining non-alphabetic displaying characters in the first email message, where determining the non-alphabetic displaying characters includes a per-character analysis that recursively determines for each character whether: a character is a non-alphabetic character; if the character is a non-alphabetic character, whether the character is a space; if the character is a space, determine whether the space is adjacent to a solitary “i” or “a”; in response to a determination that the space is not adjacent to a solitary “i” or “a”, deleting the non-alphabetic character; and if the non-alphabetic character is not a space, filtering the determined non-alphabetic displaying characters from the first email message; generating a phonetic equivalent for each word that includes only alphabetic displaying characters that has a phonetic equivalent; tokenizing the phonetic equivalents in a displaying portion of the text body to generate a plurality of body tokens representative of words in the text body; tokenizing the simple mail transfer protocol email address to generate an address token representative of the simple mail transfer protocol email address; tokenizing the domain name to generate a domain token that is representative domain name; tokenizing the attachment to generate an attachment token that is representative of the attachment, wherein tokenizing comprises: generating a 128-bit MD5 hash of the attachment; appending the 32-bit string to the generated MD5 hash to produce a 160-bit number; and UUencoding the 160-bit number to generate the attachment token representative of the attachment; determining a corresponding spam probability value for each of the plurality of body tokens, the address token, the domain token, and the attachment token; determining whether at least one of the plurality of body tokens, the address token, the domain token, and the attachment token is present in a database of tokens and, in response to a determination that at least one of the plurality of body tokens, the address token, the domain token, and the attachment token is present in the database of tokens: updating the spam probability value of the plurality of body tokens, the address token, the domain token, and the attachment token; and sorting the plurality of body tokens, the address token, the domain token, and the attachment token in accordance with the corresponding spam probability value to determine a predefined number of interesting tokens, the predefined number of interesting tokens being a subset of the plurality of body tokens, the address token, the domain token, and the attachment token; classifying the plurality of body tokens, the address token, the domain token, and the attachment token as spam, non-spam, or neutral; selecting the predefined number of interesting tokens, to create selected interesting tokens, the selected interesting tokens being the plurality of body tokens, the address token, the domain token, and the attachment token having a greatest non-neutral probability values; performing a Bayesian analysis on the selected interesting tokens to generate a spam probability; categorizing the first email message as a function of the spam probability; and filtering a second email message.