A mail server makes use of characteristics of the transport and/or application layer flow (e.g., TCP and SMTP) of received email to determine whether those characteristics are consistent with spam, for example, exhibiting behavior consistent with traffic competing for link access, large round trip times and resource constrained hosts. In some examples, a statistical technique is used to process flow characteristics of a message, optionally with other characteristics of the message, to characterize the message as spam versus a valid message.