The Markov chain model was used to detect unusual behavior in the SendMail program. By analyzing the program's actions in different ways, the model could identify anomalies without needing special security knowledge.