An e-mail client serves to detect mass mailing malware by detecting if
over a threshold number of addressees from within the address book of
that e-mail client are being sent an e-mail or over a predetermined
number of substantially identical e-mails are being sent by that e-mail
client. A quarantine queue may be provided in which e-mail messages are
held for a predetermined period prior to being sent out in order that
separate e-mail messages being sent to a large proportion of the address
book addressees may be identified and linked together.