Electronic mail monitoring

A transmission mail server comprising:

• a memory that stores a program describing processing details as a plurality of steps;
• and
• a CPU that reads the program from the memory and executes a plurality of processing based on each of the plurality of steps;
• and
• wherein the plurality of processing comprise:
• an authentication processing for authenticating a user;
• a storage processing for storing authentication information used for the authentication;
• an acquisition processing for, when the authentication processing has succeeded in authentication of the user by using the authentication information stored in the storage processing, acquiring electronic mails transmitted from communication terminals;
• an extraction processing for extracting user identification information indicating the user having transmitted the electronic mail, from the authentication information and then extracting communication terminal identification information imparted to the communication terminal having transmitted the electronic mail, from the electronic mail acquired by the acquisition processing or connection processing with the communication terminal;
• a calculation processing for, for each user identification information extracted by the extraction processing within a unit time, calculating a uniqueness number of the communication terminal identification information;
• a verification processing for judging whether the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation processing has exceeded a predetermined first threshold;
• and
• a notification processing for, performing predetermined notification to a notification destination set up in advance;
• wherein, when the verification processing has judged that the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation processing has exceeded the first threshold, the calculation processing calculates a uniqueness number of countries or regions on the basis of the communication terminal identification information for each user identification information extracted by the extraction processing within a unit time;
• the verification processing judges whether the uniqueness number of countries or regions for each of the user identification information calculated by the calculation processing has exceeded a predetermined second threshold;
• and
• the notification processing does not perform the first notification and, when the verification processing has judged that the uniqueness number of countries or regions for each of the user identification information calculated by the calculation processing has exceeded the second threshold, performs predetermined second notification to the notification destination.