18. The apparatus as recited in claim 15 , wherein sampling the messages comprises: sampling the messages associated with the authorized user until a number of new words or phrases detected per transmission falls below a threshold.
15. An apparatus, comprising: a processor; and a memory to store computer program instructions, the computer program instructions when executed on the processor cause the processor to perform operations comprising: sampling messages associated with an authorized user of an account to provide a plurality of message samples; creating an authorized profile based on language patterns extracted from the plurality of message samples; comparing a language pattern extracted from a recent message with the authorized profile to determine a deviation between the language pattern extracted from the recent message and the authorized profile; determining that the recent message is an unauthorized user account communication when the deviation is not within an allowable amount of deviation, the allowable amount of deviation being based on an amount of samples in the plurality of message samples; and generating an alert indicating that the recent message is an unauthorized user account communication in response to the determining that the recent message is an unauthorized user account communication.