A system including a metrics server and a messaging server is provided. The metrics server receives traffic data describing instant messages sent via the messaging server, and from the traffic data generates and updates suspicion indices corresponding to the computing devices that sent the messages. The suspicion indices are passed to the messaging server, which can modify its handling of subsequent messages based on the suspicion indices of the senders.