1. A computerized method for message processing, comprising: generating a simulated phishing message, the message comprising a predetermined identifier in the message or in metadata of the message; electronically storing the predetermined identifier in a computerized data store; receiving a notification triggered by a user action by an individual that a message delivered in an account associated with the individual has been identified by the individual as a possible phishing attack; determining whether the reported message is a known simulated phishing attack by comparing the predetermined identifier to an identifier from the message or to the metadata of the reported message; if the reported message is determined not to be a known simulated phishing attack based on the comparison of the identifier, associating the reported message with a message cluster, the message cluster being defined as a group of messages having at least one characteristic in common with the reported message; and displaying a graphical representation of the message cluster, each of the group of messages displayed in the cluster having been determined not to be a known simulated phishing attack based on the comparison of the identifier.