A computer-implemented method, the method being performed by a computing platform and comprising the steps of: generating (202, 510), based on email data received from a plurality of user accounts, a plurality of user identification models, wherein each of the plurality of user identification models is specific to one of the user accounts; intercepting (203, 207, 214, 228, 235, 515) a first email message from a first user account of the plurality of user accounts to a second user account of the plurality of user accounts; applying (204, 208, 215, 229, 236, 520) a first model of the plurality of user identification models to the first email message to calculate a first plurality of feature vectors for the first email message, wherein the first model of the plurality of user identification models is specific to the first user account of the plurality of user accounts; applying (205, 206, 209, 210, 216, 217, 230, 231, 237, 238) one or more impersonation algorithms to the first plurality of feature vectors, wherein applying the one or more impersonation algorithms to the first plurality of feature vectors results (205, 209, 216, 230, 237) in a confidence score indicative of a likelihood that the first email message is an impersonated message and indicates that the first email message is an impersonated message; and based on results of the one or more impersonation algorithms, modifying (241, 540, 550, 560, 565) delivery of the first email message; wherein the results of the one or more impersonation algorithms are determined by: determining that the confidence score exceeds a predetermined impersonation threshold; determining (211, 218, 232, 239, 530) a deviation value between the confidence score and the predetermined impersonation threshold; and comparing (535, 545, 555) the deviation value to a plurality of deviation thresholds comprising a first deviation threshold, a second deviation threshold greater than the first deviation threshold, and a third deviation threshold greater than the second deviation threshold; and wherein the plurality of deviation thresholds is retuned based on a target percentage of email messages to be flagged as impersonated, wherein the retuning is based on one or more machine learning datasets comprising indications of identified impersonated messages. generating (202, 510), based on email data received from a plurality of user accounts, a plurality of user identification models, wherein each of the plurality of user identification models is specific to one of the user accounts; intercepting (203, 207, 214, 228, 235, 515) a first email message from a first user account of the plurality of user accounts to a second user account of the plurality of user accounts; applying (204, 208, 215, 229, 236, 520) a first model of the plurality of user identification models to the first email message to calculate a first plurality of feature vectors for the first email message, wherein the first model of the plurality of user identification models is specific to the first user account of the plurality of user accounts; applying (205, 206, 209, 210, 216, 217, 230, 231, 237, 238) one or more impersonation algorithms to the first plurality of feature vectors, wherein applying the one or more impersonation algorithms to the first plurality of feature vectors results (205, 209, 216, 230, 237) in a confidence score indicative of a likelihood that the first email message is an impersonated message and indicates that the first email message is an impersonated message; and based on results of the one or more impersonation algorithms, modifying (241, 540, 550, 560, 565) delivery of the first email message; wherein the results of the one or more impersonation algorithms are determined by: determining that the confidence score exceeds a predetermined impersonation threshold; determining (211, 218, 232, 239, 530) a deviation value between the confidence score and the predetermined impersonation threshold; and comparing (535, 545, 555) the deviation value to a plurality of deviation thresholds comprising a first deviation threshold, a second deviation threshold greater than the first deviation threshold, and a third deviation threshold greater than the second deviation threshold; and determining that the confidence score exceeds a predetermined impersonation threshold; determining (211, 218, 232, 239, 530) a deviation value between the confidence score and the predetermined impersonation threshold; and comparing (535, 545, 555) the deviation value to a plurality of deviation thresholds comprising a first deviation threshold, a second deviation threshold greater than the first deviation threshold, and a third deviation threshold greater than the second deviation threshold; and wherein the plurality of deviation thresholds is retuned based on a target percentage of email messages to be flagged as impersonated, wherein the retuning is based on one or more machine learning datasets comprising indications of identified impersonated messages.