Specifically, I've been taking a look at image spam at a higher level.  I haven't worked on any image scanning technology, but I have been measuring what types of images spammers send.

The two main types of images, not surprisingly, are jpgs and gifs.  But what is really surprising to me is the amount of day-to-day variance there is which images they prefer to use.  I don't have the numbers handy but it's something like the following: on Monday of last week, the gif/jpg split was 80/20.  On Tuesday, it was 60/40.  On Wednesday, it was 75/25.  I found this quite surprising that there was so much variance even within the various days of the week.  Clearly, some spammers have a preference for different types of images.

Those aren't the actual numbers (I made them up for illustrative purposes).  But what it indicates is that if jpg sending patterns and gif sending patterns suddenly ramp up relative to historical averages, we can probably use that as a method of identifying sending IPs as spamming.