In one embodiment, a method for operating a server is provided. The method comprises receiving a plurality of reports from a community of users, each report identifying an email message as spam or not spam; and determining if the email message is spam based on a number of the reports received from the community of users, and a trust factor associated with each user.