15. The computer program product of claim 13 , the method further comprising: accessing one or more of the user's past communications with one or more persons in the generated data structure; and based on the past communications, adjusting the indication of likelihood that the user will encounter malware.
16. The computer program product of claim 15 , wherein accessing past communications comprises accessing email metadata for one or more previous email communications.