1. A method comprising: training an email system for determining spam, where training includes at least the following: tokenizing at least a portion of a first email message to create a token; determining, from the token, a spam probability for the first email message; in response to a determination that a spam probability from the token indicates that the first email message is likely spam, determining whether the generated token is present in a database of tokens, in response to a determination the generated token is not present in the database of tokens, assigning a probability value for the generated token as spam; and in response to a determination that the spam probability from the generated token indicates that the first email message is not likely spam, determining whether the generated token is present in a database of tokens; and filtering a second email message according to the training.