On Graham-Cumming, POPFile, and which side of the spam problem Cloudflare actually knows

A reader emailed after my Email Service post to flag something I had missed. John Graham-Cumming, Cloudflare’s CTO until March 2025 and now a board member, has a long pre-Cloudflare history in spam detection. The implication is that the deliverability question I raised, whether Cloudflare can survive the reputation game given their existing abuse posture, has a more credible answer at the top of the company than I credited. The reader is right that I missed it, and the credentials are more substantial than ‘has thoughts on email.’ Graham-Cumming wrote POPFile, the open-source Bayesian email classifier, starting in 2002. It won a Jolt Productivity Award in 2004 and ran on POP3 proxies on hundreds of thousands of desktops at its peak. He presented ‘How to Beat a Bayesian Spam Filter’ at the MIT Spam Conference in 2004, which became one of the foundational papers in the Bayesian poisoning literature and is still cited in academic work on adversarial machine learning two decades later. He…