A method of monitoring email use is performed at a server system by monitoring email use in a first email application at a first device distinct from the server system and monitoring email use in a second email application at a second device distinct from the server system. An inconsistency in the monitored email use is detected for a first email that is received by the second device and appears to have been sent from the first device. In response to detecting the inconsistency, the first email is identified as being potentially malicious. At least one of the first and second devices may be notified that the first email is potentially malicious.