My perspective on design of spam filtration solutions is centered around exploitation of the various constraints of the spammer. One thing we don't talk about enough is the fact that spammers have rather serious constraints. They have to send out a marketing message (containing the same meme) to millions of people from (at most) a few thousand different IP addresses. They have to do this in a relatively short period of time. They have to differentiate their content from other spam. They have to defeat existing spam filtration systems
...
Here's a list of three rules (created after the most important features of e-mail) that anti-spam software should strive to follow: 1) Ability to send and receive e-mail from a stranger. (Whitelisting, payment systems, and challenge/response break this rule.) 2) Ability to send and receive pseudo-anonymous e-mail. (Domain-based authentication breaks this rule.) 3) E-mail should be free. (Payment systems break this rule.)