In the method of the present invention, spam is detected by extracting generalized Ngrams from a section of an e-mail (104). A spam manager (101) extracts (502) a sequence of characters from a section of an email. The spam manager (101) iterates (504) subsequences within the sequence. The spam manager (101) compares (506) subsequences to collections of spam-distinguishing subsequences to identify spam e-mail (104) messages.