How does an email service recognize spam it has never seen before?

Filters combine sender reputation, links, language patterns, authentication checks, and feedback from similar messages to estimate the chance of abuse.