1. A computing system implemented process for employing honeypot systems to identify potential malware containing messages comprising: providing one or more honeypot computing systems; providing one or more decoy e-mail addresses associated with the one or more honeypot computing systems; receiving one or more e-mails at one of the one or more decoy e-mail addresses associated with the one or more honeypot computing systems; using one or more processors associated with one or more computing systems to perform a preliminary filtering of the one or more e-mails received at the one or more decoy e-mail addresses associated with one or more honeypot computing systems; as a result of the preliminary filtering of the one or more e-mails received at the one or more decoy e-mail addresses associated with one or more honeypot computing systems, identifying one or more of the one or more e-mails as potential malware containing e-mails; using one or more processors associated with one or more computing systems to extract a feature or feature value associated with one or more of the identified potential malware containing e-mails, wherein the identified potential malware containing e-mails comprise various respective sets of feature or feature values, each set of feature values comprising a plurality of individual feature values, wherein a plurality of the identified potential malware containing e-mails have at least one individual feature value in common; defining a burst threshold for the individual feature or feature value such that when the individual feature or feature value occurs in a number of emails exceeding the burst threshold number of times in a defined period of time, the feature or feature value is considered an indicator of malware containing e-mail; using one or more processors associated with one or more computing systems to detect that the extracted feature or feature value occurs in a number of emails more than the burst threshold number of times in the defined period of time; responsive to the detection, transforming a status of the individual feature or feature value from a first feature status into a status of suspicious e-mail parameter; using one or more processors associated with one or more computing systems to distribute the suspicious e-mail parameter to one or more security systems or one or more e-mail systems for use in identifying potential malware containing e-mails being sent to one or more user computing systems through the one or more security systems or the one or more e-mail systems; and determining that the suspicious e-mail parameter has not been observed within a predefined number of e-mails within a predefined time frame, and transforming, as a result of the determination, the suspicious e-mail parameter back to the status of a feature.