1. A metrics server, comprising: a memory; a network interface connecting the metrics server to a messaging server configured to deliver messages containing message content from a first communication device to at least one other communication device; and a processor interconnected with the memory and the network interface, and operating to: receive, from the messaging server via the network interface, traffic data associated with the first communication device, the traffic data excluding the message content; update a suspicion index corresponding to the first communication device based on the traffic data, the suspicion index indicating a likelihood that the first communication device is an originator of spam messages; and transmit the suspicion index to the messaging server.