1. A method for sending notifications regarding declassification of suspicious messages, the method comprising: intercepting a suspicious message at a message filter, wherein the message is addressed to a plurality of recipients; executing instructions stored in memory, wherein execution of the instructions by a processor: identifies that the plurality of recipients include an individual user and one or more mailing lists, determines that the individual user is also subscribed to the one or more mailing lists, and generates a notification for each of the plurality of recipients, wherein a notification to the individual user is coalesced with a notification to the user as subscriber of the one or more mailing lists; and sending the coalesced notification to the user, wherein the user receives only one notification regarding the suspicious message.