1. A computer-implemented method for detection of spam, the method comprising: receiving, by a computer processor, a plurality of electronic messages; classifying the received plurality of messages as legitimate or spam messages; identifying unknown messages that could not be classified as legitimate or spam; obtaining a metadata of the unknown messages, the metadata including at least a hash sum for an unknown message and an address of a sender of the unknown message; placing the metadata of the unknown messages into one cluster of a plurality of clusters based on degree of similarity between hash sums of different unknown messages; rating each unknown message in accordance with a rating of the cluster where the metadata of the unknown messages was assigned to, wherein the rating of the cluster is based, at least, on a number of similar hash sums of unknown messages received from different addresses of message senders contained in said cluster; and classifying unknown messages as legitimate or spam based on message ratings.