Email monitoring to identify worms