A spam detector for determining likelihood of forgery of a source in an email addressed to a destination is provided, comprising extraction means for extracting delivery path information from one or more packets in the packet flow of the email, and comparison means for comparing the extracted delivery path information with trusted delivery path information from the source to the destination.