14. The method as recited in claim 1 , wherein defining a model relating to transmission behavior of prior email comprises defining a model derived from statistics relating to transmission behavior of emails of one of said email accounts.
1. A method for detecting a violation of an email security policy of a computer system by transmission of selected email through said computer system, said computer system comprising a server and one or more clients having an email account, the method comprising: (a) defining a model relating to prior transmission of email through said computer system derived from statistics relating to transmission behavior of prior emails transmitted through said computer system, wherein defining the model comprises grouping email addresses in said prior emails into one or more cliques based on the occurrence of said email addresses in common prior emails; (b) gathering statistics relating to transmission behavior of a selected email through said computer system; and (c) classifying said selected email as being a member of a classification comprising violative of a security policy and non-violative of a security policy by applying said model to said statistics relating to said transmission behavior of said selected email through said computer system based on whether email addresses in said selected email are members of more than one said clique.