Systems and methods for identifying a spam email message. A system can include a rules database configured to store a plurality of ratio determination rules, a vectors database configured to store a plurality of known vectors, a message processing tool configured to receive an email message, a gram building tool configured to build a k-skip-n-gram set of word combinations according he ratio determination rules, a vector building tool configured to receive the k-skip-n-gram set of word combinations, and build a vector for each k-skip-n-gram word combination, and a spam identification tool configured to determine a spam presence threshold based on the cosine similarity for each k-skip-n-gram word combination and the plurality of known vectors for the particular email message subject field subject category, and determine that the email message contains spam when the spam presence threshold is exceeded.