The reputation filtering spam engine of Astaro works in a similiar fashion to the virus-spreading screen in the movie outbreak. [:)] Basically, the determination is done regarding various factors, but primarily "how" a message propagates and spreads around the globe. Using a really cool message fingerprinting technology, all devices and collectors using this system can share message activity fingerprints. As such, if an exact mail is suddenly seen spreading 200,000+ times and behaves or 'looks' like a spam mailing, that message is instantly flagged as "Confirmed" or "Suspected" spam, and thus all devices which ask for information about that message fingerprint will treat it as such.
Essentially the global system allows for tagging and identification, along with communication/alerting of a message and how it should be handled.
