1. A computer-implemented method for filtering spam and legitimate e-mail, the method comprising: a spam manager executing on a computer and receiving an e-mail; the spam manager performing a signature-based analysis of the e-mail to determine whether the e-mail includes at least one signature indicative of spam; responsive to the spam manager determining that the e-mail does not include at least one signature indicative of spam and to a timeout period measured from a time of receipt of the e-mail by the spam manager having not transpired, the spam manager performing at least one secondary analysis of the e-mail; the spam manager holding the e-mail for further processing, responsive to at least one secondary analysis failing to exclude that the e-mail comprises spam; and the spam manager classifying the held e-mail as legitimate, responsive to not receiving updated spam signatures before the timeout period transpires.