An email inspection system receives emails that are addressed to recipients of a private computer network. The emails are inspected for malicious content, and security information of emails that pass inspection is recorded. When an email is detected to have malicious content, the recorded security information of emails is checked to identify compromised emails, which are emails that previously passed inspection but include the same malicious content. A notification email is sent to recipients of compromised emails. The notification email includes Simple Mail Transfer Protocol headers that facilitate identification of the recipients, blocking of incoming emails with the same malicious content, and identification of public Mail Transfer Agents that send malicious emails, i.e., emails with malicious content.