I want to have an admin page to manage user messages reported as 'spam'. I know how to use MySql and php to have a list of messages reported but I don't know what is the more safe way to access to this page. Local, https,... What strategy use big websites as Facebook, MySpace,... to verify that a message is a true spam and to delete it?
They use spam filtering - very often implemented using Bayesian spam filters
I'm not clear what you're asking here:
what is the more safe way to access to this page. Local, https,.
What's your criteria for 'safe'? What relevance does this have specifically to email analysis?
What strategy use big websites as Facebook, MySpace,... to verify that a message is a true spam and to delete it?
There are lots of approaches - owever the problem is that providers don't publish information about how they filter spam so that the spamers can't learn to get around it.
DVK mentioned Bayesian filtering - one of the features of this is that even the people who maintain the filters don't understand how they classify a message as spam or not.
An exception to the secrecy thing is SPF - checking SPF records is a good idea.
ClamAV includes signatures for common phishing and spam messages
You might also want to have a look at spamassassin and some of the add-on rules
HTH
C.