Computer implemented methods, apparati, and computer readable media for determining whether an electronic message (30) is likely to contain spam. A method embodiment of the present invention comprises the steps of comparing (11) addresses associated with the electronic message (30) with addresses in an address book (21) of a recipient (20) of the electronic message (30); counting (12) instances for which an address associated with the electronic message (30) matches an address in the address book (21); and determining (13) whether spam is likely present in the electronic message (30) by calculating whether a pre-selected condition (70) is satisfied, said pre-selected condition (70) being based upon a count of said matches and at least one predetermined threshold (80).