Methods, computer readable media, and apparatuses for monitoring communications are presented. A first username may be compared with a second username. The first username may be associated with a sender of a communication, and the second username may be associated with a recipient of the communication. Thereafter, based on the comparing, the probability that the first username and the second username are both associated with a single entity may be determined. In at least one arrangement, in response to determining that the probability exceeds a threshold, it may be determined that the first username and the second username are both associated with the single entity. In at least one additional arrangement, the threshold may be modified automatically based on previously analyzed incident data.