A method of filtering an electronic mail in an electronic mail system, the method comprising steps of: - providing an electronic graph representation of non-content electronic mail related characteristics derived from the history of electronic mail exchange in the electronic mail system in a data base, comprising - providing a plurality of electronic pairs of sender and recipient information both related to one electronic mail, wherein the sender and recipient information comprises sender and recipient address, and wherein the sender and recipient address are hashed, and - generating the electronic graph representation with a plurality of graphical vertices assigned to the sender and recipient address and a plurality of directed graphical edges assigned to the pairs of sender and recipient address, wherein - the directed graphical edges are originating from a vertex assigned to the sender address and ending at a vertex assigned to the recipient address, and - a weight of an edge is the number of emails between the two nodes of the graph representation assigned to the sender and recipient address, and - assigning to a present electronic mail provided for transmission in the electronic mail system an electronic indicator indicative of a potential abusive mail character of the present electronic mail, comprising: - parsing the present electronic mail, - processing parsed information derived from the parsing of the present electronic mail, and - providing the electronic indicator indicative of the potential abusive mail character of the present electronic mail by analyzing present electronic mail characteristics derived from the parsed information based on the graph representation in the data base, wherein deriving the electronic mail related characteristics from the electronic mail exchange history comprises a step of analyzing electronic mails handled by at least one node provided in the electronic mail system. - providing an electronic graph representation of non-content electronic mail related characteristics derived from the history of electronic mail exchange in the electronic mail system in a data base, comprising - providing a plurality of electronic pairs of sender and recipient information both related to one electronic mail, wherein the sender and recipient information comprises sender and recipient address, and wherein the sender and recipient address are hashed, and - generating the electronic graph representation with a plurality of graphical vertices assigned to the sender and recipient address and a plurality of directed graphical edges assigned to the pairs of sender and recipient address, wherein - the directed graphical edges are originating from a vertex assigned to the sender address and ending at a vertex assigned to the recipient address, and - a weight of an edge is the number of emails between the two nodes of the graph representation assigned to the sender and recipient address, and - providing a plurality of electronic pairs of sender and recipient information both related to one electronic mail, wherein the sender and recipient information comprises sender and recipient address, and wherein the sender and recipient address are hashed, and - generating the electronic graph representation with a plurality of graphical vertices assigned to the sender and recipient address and a plurality of directed graphical edges assigned to the pairs of sender and recipient address, wherein - the directed graphical edges are originating from a vertex assigned to the sender address and ending at a vertex assigned to the recipient address, and - a weight of an edge is the number of emails between the two nodes of the graph representation assigned to the sender and recipient address, and - the directed graphical edges are originating from a vertex assigned to the sender address and ending at a vertex assigned to the recipient address, and - a weight of an edge is the number of emails between the two nodes of the graph representation assigned to the sender and recipient address, and - assigning to a present electronic mail provided for transmission in the electronic mail system an electronic indicator indicative of a potential abusive mail character of the present electronic mail, comprising: - parsing the present electronic mail, - processing parsed information derived from the parsing of the present electronic mail, and - providing the electronic indicator indicative of the potential abusive mail character of the present electronic mail by analyzing present electronic mail characteristics derived from the parsed information based on the graph representation in the data base, - parsing the present electronic mail, - processing parsed information derived from the parsing of the present electronic mail, and - providing the electronic indicator indicative of the potential abusive mail character of the present electronic mail by analyzing present electronic mail characteristics derived from the parsed information based on the graph representation in the data base,