  We propose a new detection algorithm that uses structural relationships
between senders and recipients of email as the basis for the identification of
spam messages. Users and receivers are represented as vectors in their
reciprocal spaces. A measure of similarity between vectors is constructed and
used to group users into clusters. Knowledge of their classification as past
senders/receivers of spam or legitimate mail, comming from an auxiliary
detection algorithm, is then used to label these clusters probabilistically.
This knowledge comes from an auxiliary algorithm. The measure of similarity
between the sender and receiver sets of a new message to the center vector of
clusters is then used to asses the possibility of that message being legitimate
or spam. We show that the proposed algorithm is able to correct part of the
false positives (legitimate messages classified as spam) using a testbed of one
week smtp log.
