With the accessibility of ML these days, I'm less convinced that spam protection is that hard, if you have a little bit of patience. The spam I get is repetitive and bad, and I get enough of it that I think I could get a workable model simply by using Gmail's spam tagging to train it.
Back in the day ('noughties through 2015 or so) there was POPFile, which did Bayesian classification of emails for spam filtering. John Graham-Cumming wrote it, and it worked reasonably well. I still think of him as the POPFile guy first, then remember he's the Cloudflare CTO.
A more advanced classifier certainly do better these days.
