A system comprising email processing circuitry, web server circuitry, third-party interface circuitry, and a database, wherein the database stores information about a plurality of users. The system receives, via a network, a first email message and generates a modified first email message by insertion of a link to remotely-hosted content in the received email message. The system transmits, via a network interface, the modified first email message. The system receives, via a network, a request for the remotely-hosted content, and updates the database based on information contained in the request for the remotely-hosted content. The system receives, via a network, information about activity on a third-party system, and updates the database based on the information about activity on the third-party system. The system receives a second email message, determines an action to take on the second email message based on information in the database, and takes the action.