34. The method as recited in claim 33 , wherein defining a model relating to prior email comprises defining a model relating to statistics accumulated over a predetermined time period.
33. A method for detecting a violation of an email security policy of a computer system by transmission of selected email through said computer system, said computer system comprising a server and one more clients having an email account, the method comprising: (a) defining a model relating to transmission behavior of prior email transmitted by said email account derived from statistics relating to transmission behavior of prior emails transmitted by said email account, wherein defining the model comprises grouping email addresses in said prior emails into one or more cliques based on the occurrence of said email addresses in common prior emails; (b) gathering statistics relating to transmission behavior of said selected emails transmitted by said email account; (c) defining a model of said new email transmission behavior derived from said statistics; and (d) comparing said model of said new email transmission behavior and said model relating to prior email transmission behavior by said email account based on whether email addresses in said new email are members of more than one said clique.