A clustering technique is utilized to group similar e-mail messages into clusters. Statistical spamming behavior analysis is then applied to each cluster, focusing on finding e-mail messages within each cluster that differ from other e-mail messages in the cluster. The degree of variance and the type of variance can provide important clues as to whether the email is spam or not. Appropriate measures are then taken to block, filter, or otherwise handle the suspected spam e-mail messages.