1. A method comprising: transmitting a first email, classified at a spam filter as not-spam-email, to each of a plurality of user computers; receiving a report from a user computer of the plurality of user computers indicating whether the first email, previously classified at the spam filter as not-spam-email, is spam; upon receiving the report, checking entries, in a user reputation database, related to a reputation of the user computer; and if the reputation of the user computer is indicated as a bad reputation and the user computer incorrectly identified the first email as not-spam-email, identifying the user computer as having been compromised.