Patent ID: 7548544

Claim:
A method, comprising the computer-implemented steps of: receiving a plurality of electronic mail messages containing sender address information that is non-trusted; for each particular one of the electronic mail messages: storing information about the particular message in a database record; creating and storing one or more receiving node identifiers in association with respective connected node identifiers, wherein the receiving node identifier identifies a receiving mail server that received the particular message and the connected node identifier identifies a connected mail server that directly connected to the receiving mail server to send the particular message directly to the receiving mail server; based on the associations between the receiving node identifiers and the respective connected node identifiers, selecting one particular receiving node identifier that has a largest number of directly connected node identifiers associated therewith; selecting one particular connected node identifier that is associated with the one particular receiving node identifier that has the largest number of the associated connected node identifiers; storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.