Spam Classification and Review Queues for suspicious mails

I would like to have a spam filtering system in Zammad, following some simple mechanisms.
I have followed various posts over the last years, but nothing really seemed to fit what I was looking for.
And as many mentioned, filtering by the mail system is tricky cause you cannot properly review things.

Two main aspects I want to consider:

  • new users (no other tickets from this address so far) - maybe spam (we have an established customer base so most relevant mails will come from existing mails
  • recipient emails - many spam mails are sent to odd or undisclosed recipients - with some finesse many of these could probably be outright discarded, but basically I would like to set the acceptable recipient mail domains (since we work with redirects) and tag everything else as likely spam

The question is, how do I implement such filters in a way that:

  • checks matching incoming mails for the two aforementioned categories with a “review queue” (own filtered view) for each
  • hides them from all other views until approved

I had a few ideas:

  • for classification, using tags or own organizations
  • an own organization could also help for hiding them from all other views, cause I do not fancy manually adding a tag excluded filter for every other view - maybe with an own user account that I sign in to review them while thy are hidden from everyone else?
  • playing with states, either closed or pending close, to hide them from other views

This for me seems a very straightforward procedure that might even make sense in Zammad core - cause honestly in the current state the usability really suffers once you start receiving spam and unsolicited marketing if you also want to make sure you do not miss any customer emails

Further idea: Instead of acting on incoming mails, have a recurring job check e.g. for customers with only a single ticket and classify them such - may add more flexibility through ruby scripting