Concerning the problem brought by a large number of spam, an incremental passive attack learning algorithm was proposed. The passive attack learning method was based on the Simple Mail Transfer Protocol (SMTP) session log initiated by the email host in the campus during half a year. Analysis on the status of delivery rate and many types of failure message of the host behavior in the session record was conducted, and the effective adaptation was ultimately achieved by detecting spam source host behavior on the recent email classification. The experimental results show that after implementing several rounds of classification strategy adjustment, the detection accuracy of the proposed model can reach 94.7%. The design is very useful to effectively detect internal spam host and control the spam from the source.