A method in one example implementation includes providing a memory component with one or more alternative email entries associated with a plurality of name records. The name records represent one or more authorized users of a network. The method further includes determining whether any of the one or more alternative email entries corresponds to a sender email address in an incoming email message, where the incoming email message is being sent from the sender email address to at least one official email address associated with the network. In more specific embodiments the method includes tagging the incoming email message with a first or second flag depending on whether any of the one or more alternative email entries corresponds to the sender email address and whether a username of the sender email address includes an identifiable portion of one of the plurality of name records.