A system for monitoring a plurality of mailboxes, being email message stores associated with respective email accounts, (202-1...202-6) hosted in a plurality of servers (120-1...120-5) by a plurality of computer nodes (110-1, 110-2, 110-3), each of the computer nodes (110-1, 110-2, 110-3) being configured to establish respective monitoring sessions (122-1...122-6) with one or more of said servers (120-1...120-5), the plurality of computer nodes comprising a first computer node comprising at least one first processor and at least one first memory comprising first computer program instructions, and a second computer node comprising at least one second processor and at least one second memory comprising second computer program instructions, wherein: - the at least one first memory and the first computer program instructions are configured to, with the first processor, cause the first computer node to: monitor a plurality of message stores hosted by a first server of said plurality of servers (120-1...120-5), the first server being remote from the first computer node; receive an attribute associated with a message store in the plurality of message stores; and update a database record associated with the message store to store data indicative of the attribute; and - the at least one second memory and the second computer program instructions are configured to, with the second processor, cause the second computer node to: detect the update, made by the first computer node, to the database record; determine, in response to detecting the update to the database record, a third computer node in the plurality of computer nodes (110-1, 110-2, 110-3) to monitor the message store, based at least in part on the data indicative of the attribute stored in the database record; and update the database record to store an identifier corresponding to the third computer node. - the at least one first memory and the first computer program instructions are configured to, with the first processor, cause the first computer node to: monitor a plurality of message stores hosted by a first server of said plurality of servers (120-1...120-5), the first server being remote from the first computer node; receive an attribute associated with a message store in the plurality of message stores; and update a database record associated with the message store to store data indicative of the attribute; and monitor a plurality of message stores hosted by a first server of said plurality of servers (120-1...120-5), the first server being remote from the first computer node; receive an attribute associated with a message store in the plurality of message stores; and update a database record associated with the message store to store data indicative of the attribute; and - the at least one second memory and the second computer program instructions are configured to, with the second processor, cause the second computer node to: detect the update, made by the first computer node, to the database record; determine, in response to detecting the update to the database record, a third computer node in the plurality of computer nodes (110-1, 110-2, 110-3) to monitor the message store, based at least in part on the data indicative of the attribute stored in the database record; and update the database record to store an identifier corresponding to the third computer node. detect the update, made by the first computer node, to the database record; determine, in response to detecting the update to the database record, a third computer node in the plurality of computer nodes (110-1, 110-2, 110-3) to monitor the message store, based at least in part on the data indicative of the attribute stored in the database record; and update the database record to store an identifier corresponding to the third computer node.