There are two questions that come to mind: 1) who the current clients are; and 2) how much time the two experts spent on examining the system. As mentioned in one of the comments, the system may work in closed environment, but I seriously doubt that it will work in general email systems.
Here's a simple attack that allows spammer to put a huge amount of spam into Hotmail inbox, should current Hotmail spam algorithms be replaced by what is proposed here. First, the spammer creates a large amount of its own Hotmail accounts. Second, the spammer sends say 70% of his spam to his accounts and 30% to normal users (percentages can be adjusted). The spammer's own accounts are in good standing and receive no spam at all. In fact, spammer never complains about spam in his INBOX (that he send himself) and keeps the email address confidential. When the above attack is launched, the system will detect that a large amount of emails went to clean accounts that receive no spam, and the system will conclude that the email itself is clean as well. Thus, the spammer will be able to put 30% of his spam directly into INBOX of users, which would be great outcome.
Slashdot Mirror
There are two questions that come to mind: 1) who the current clients are; and 2) how much time the two experts spent on examining the system. As mentioned in one of the comments, the system may work in closed environment, but I seriously doubt that it will work in general email systems. Here's a simple attack that allows spammer to put a huge amount of spam into Hotmail inbox, should current Hotmail spam algorithms be replaced by what is proposed here. First, the spammer creates a large amount of its own Hotmail accounts. Second, the spammer sends say 70% of his spam to his accounts and 30% to normal users (percentages can be adjusted). The spammer's own accounts are in good standing and receive no spam at all. In fact, spammer never complains about spam in his INBOX (that he send himself) and keeps the email address confidential. When the above attack is launched, the system will detect that a large amount of emails went to clean accounts that receive no spam, and the system will conclude that the email itself is clean as well. Thus, the spammer will be able to put 30% of his spam directly into INBOX of users, which would be great outcome.