40. A system for detecting an occurrence of a violation of an email security policy of a computer system by transmission of selected email through said computer system comprising: a client comprising: (i) an email server configured to receive and transmit said selected email for one or more email accounts; (ii) a client database configured to store information relating to said selected email and a model derived from statistics relating to transmission behavior of prior emails transmitted through said computer system; and (iii) an analysis component configured to define a model for said selected email based on statistics relating to transmission behavior of said selected email, wherein the model is configured to group email addresses in said prior emails into one or more cliques based on the occurrence of said email addresses in common prior emails and compare said selected email model and said model derived from statistics relating to transmission behavior of said prior emails based on whether email addresses in said new email are members of more than one said clique; (iv) a communications component configured to transmit statistics relating to the selected email to a server.
46. The system as recited in claim 40 , wherein the analysis component is configured to compare a histogram relating to said selected email to said histogram relating to said prior email.