The evolution of email spam

There are two ways of looking at email spam.

1. It lands in your inbox, you click delete, what’s the big deal?

2. An international game of cat and mouse, where your inbox, and what lands in it, sits on the front line as big tech, government agencies, and criminal organizations do battle for your safety, your attention, and your bank account.

The second view might sound dramatic, but if it saves you a few headaches and maybe even some money, it’s worth understanding, right?

Well… it all starts with a joke about a can of tinned meat.

What is a spam email, and why is it called spam?

There are many things that spam is, advertisements, scams, junk newsletters, the list goes on. But the one thing spam isn’t is invited. Like a swarm of mosquitoes arriving at the first mention of summer, spam almost always arrives in bulk. It’s unsolicited, unwanted, and pretty darn annoying.

But why does it share its name with a can of tinned meat made from pork shoulder and ham? For that, we can thank a famous Monty Python sketch, where the word “spam” was repeated over and over, almost to the point of madness. This cemented “spam” as a symbol of the incessant and unwanted. In 1993, one savvy internet user took this idea and described a flood of repeated posts as spam, and voilà, the name stuck.

But, despite its quirky origins, the word itself doesn’t capture how damaging spam can be – or how difficult it is to get rid of. Like mosquitoes, spam emails often carry dangerous materials that can wreak havoc on your devices. Not to mention the risk to your personal data, and the migraine that can come with having your inbox flooded by shady advertisements. But understanding the history helps. If you can understand how spam finds its way into your inbox, you’ll do a better job of keeping it out.

When was the first spam email sent?

So where does spam mail come from? You might be surprised to learn that the first spam email was sent before the internet even existed. It didn’t come from some shadowy criminal group, it came from a single marketer trying to sell a new line of computers, and believe it or not, it made millions.

Back in 1978, marketing manager Gary Thuerk sent an email to around 400 people through ARPANET, the military network that came before the internet. His message was a pitch for a presentation on the new DECSYSTEM-20 computers. The email pulled in about $13 million in sales, but also annoyed nearly everyone who got it.

The most interesting part of this story from spam history is not when the email was sent, but the double-edged sword that sits behind email spam. On the one hand, there are eye-watering amounts of money to be made from advertisements sent to hundreds, thousands, or even millions of people. But, spam is very obviously annoying. Unfortunately, this is the push and pull relationship that will follow spam through its turbulent history.

How has spam evolved over the decades?

If you’re lucky enough to grow up in the era of Google and Microsoft protection, you might not remember the early days of the internet, where getting spam out of your inbox was more of a manual task.

1980s–1990s: The wild west of email

1983, one year before George Orwell’s prediction of a totalitarian superstate, something very different was taking shape. For the first time, it was made possible for multiple independent networks to connect with each other, creating the foundation for today’s global network of networks, or the internet as we like to call it.

Over the next decade, millions of new users came online and started setting up email addresses. There was no central authority to say, “you can’t do that” and email could basically serve as a free advertising channel. One message blasted to thousands, even millions, of people at almost no cost.

What was the result? In the 1990s, spam exploded, and so did efforts to control it. In 1994, lawyers Canter & Siegel launched their infamous “Green Card Lottery” ad across thousands of Usenet groups, often seen as the first major commercial spam campaign. Defenses soon followed. The Mail Abuse Prevention System (MAPS) rolled out the first Real-time Blackhole List in 1996, blocking mail from known spam servers, and groups like Spamhaus built blocklists and shared intelligence to keep spammers out.

2000s: The decade spam went dark

The 2000s may have marked the end of the millennium, but for many, it was the true beginning of annoying emails flooding inboxes. Google, Yahoo, and Microsoft all jumped on the stop spam bandwagon. But it wasn’t cheesy ads or get-rich-quick schemes anymore, spam was turning darker. Spammers had begun using “botnets,” networks of infected computers, to send out spam on a massive scale.

Governments decided it was time to step in. In 2003, the US rolled out the CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography and Marketing). It forced spammers to honor opt-out requests and avoid deceptive subject lines, but the catch was that the responsibility still landed on recipients to unsubscribe. Europe, on the other hand, went stricter. The EU set up an opt-in system for email marketing, which meant companies couldn’t send commercial emails without getting permission first.

The 2000s marked the real explosion of the cat-and-mouse game that came to define spam. Spammers would invent new tricks, and defenders would find ways to counter them. Take Bayesian filtering, for example, it scans the words in an email, runs the probabilities, and decides if it’s junk or genuine. When it first came out, it was a breakthrough in how email providers could crack down on spam. In 2004, Bill Gates even predicted the spam problem would be solved within two years. But, as always, spammers were quick to adapt.

Examples of the spam back and forth in action:

The Modern era: When spam learned to think

Stephen Hawking once warned that humans could one day be to AI what dogs are to humans, a sobering thought. And while that may sound bleak, it’s no exaggeration to say the rise of AI could be as transformative as the invention of the steam engine. It’s no wonder then that AI is shaping the battle between those seeking to profit from spam and those trying to control it. The difference is that, unlike traditional spam filters, AI can learn and adapt.

The irony here is that scammers are using the same tools to improve their spam emails as college kids use to pass their exams. Before AI tools, spam emails were riddled with typos, grammar mistakes, and obvious red flags. Now, thanks to large language models, spam emails with flawless grammar, localized tone, and personalized hooks can be sent en masse. Instead of sending 10’000 identical emails, scammers can send 10’000 slightly different emails and avoid censors. By running text through models that simulate spam scoring, attackers can tweak their messages until they appear “safe.”

Email giants are doing the same. They use AI and machine learning not just to scan content, but to analyze sender behavior, network signals, and even the context of messages. Gmail, for example, can now spot suspicious patterns, like sudden bursts of emails from new domains or content that mimics known phishing lures, and adapt in real time to shut down new spam campaigns.

What impact has spam had on email and businesses?

If we go back to the spam mail origin story, and its Monty Python namesake, the theme was simple: annoying. Back then, that’s exactly how most spam was seen. But in the decades since, it’s become far more dangerous. Clicking the wrong link can now mean viruses or serious financial loss.

And it’s not just individuals at risk. Since the 2000s, scammers have cooked up elaborate ways to go after bigger targets. Many of these schemes even have catchy nicknames that downplay just how serious the consequences can be.

Examples of spam targeted at businesses:

Mass spam and scams – Bulk emails still flood inboxes daily, from annoying ads to fake lotteries or “Nigerian prince” schemes. They’re low-level but clutter inboxes and can still trick employees.

Phishing emails – Impersonate trusted brands and lure users to fake sites. Once clumsy, these phishing emails are now polished, automated, and hard to tell from the real thing.

Spear phishing and whaling – Targeted attacks using real names or projects to fool specific employees. When aimed at execs, it’s called “whaling,” and the payoff can be massive.Business Email Compromise (BEC) – Criminals pose as CEOs, vendors, or HR to trick staff into wiring money or sending data.

Malware and ransomware – Spam often carries malicious attachments or links. One click can unleash viruses or ransomware, locking up entire systems and costing businesses millions.

But the real danger is in the scale of the consequences. Spam wastes time on an enormous level. Employees second-guessing emails or managers investigating false alarms. All of it chips away at productivity.

What spam really costs

The FBI estimates that Business Email Compromise alone drained over $50 billion between 2013 and 2022. That’s why the fight against spam keeps evolving. Filters now look beyond keywords to scan patterns, attachments, and even sender behavior. Laws like CAN-SPAM and GDPR set rules around consent and transparency. And email providers have added protections like SPF, DKIM, and DMARC, making it much harder for attackers to pose as someone they’re not.

How do we fight spam today?

Modern spam filters are powered by AI and machine learning. They can analyze sender behavior and the context of the message, and then adapt in real time.

But, awareness is still important. Even with the best spam filters, employee training needs to become a key part of stopping spam. These days, companies run regular awareness programs that teach people to slow down and spot red flags, or verify requests before acting. Some of these include:

Where to start

So what’s the lesson from decades of cat and mouse? In short, spammers will always adapt, and spam will never truly disappear, it will just evolve. So making sure your defenses do the same is your best bet. Vigilance is key. Getting yourself an email provider with advanced filtering and authentication tools is even better. Ultimately if you can layer solutions, you’ll be in the best position to defend your inbox. And if you need a reminder, Monty Python will do the trick.