Email senders may transmit emails over the internet to a mail server that handles emails for a plurality of users (clients). The mail server may use a spam filter to remove the spam and then transmit the filtered emails to the addressed clients. The spam filter may use a white list, black list, probability filter and keyword filter. The probability filter may use a user mail corpus and a user spam corpus for creating a user probability table that lists tokens and the probability that an email is a spam if the email contains the token. The probability filter may also use a general mail corpus and a general spam corpus for creating a general probability table that. Tokens of incoming emails may be searched for in the user probability table, and if not found, the general probability table to calculate the probability that the email is a spam.