Sometimes I think we need an email system that requires a simple form of authentication for incoming messages.
The thing that occurs to me right now is a sort of "token dispenser" function. The tokens could be text strings of modest length (maybe 20 to 30 characters) and pseudorandom. Maybe limited to upper and lowercase letters and digits.
I'm sort of picturing two types of tokens: "permanent" ones that work forever until deleted from your mail client's "token store" and "temporary" ones that expire after they are used for some small number (3? 5?) of emails.
If you want to correspond with somebody you give them an access token as well as your email address. The temporary ones autoexpire as they get used up, the others can be deleted by you whenever you choose - then you can generate new ones.
In turn, email clients could store tokens along with addresses in address books for your outgoing mail.
For those you correspond with regularly, you'd give out one of your "permanent" tokens. If you suspect that a spammer has compromised somebody's addressbook just delete your permanent tokens and create new ones. You might only have one or a very few permtokens at any one time.
The mail clients could be created to track who you've disclosed permtokens to. When you create a new one to replace an old one, maybe autofire special emails out to everyone on that list. Those emails could be recognized by the receiving clients (special email header?) to autoupdate the addressbooks at their end.
When you buy something online, maybe generate a new temptoken and provide that. This lets the merchant give you order updates and such, but limits the value of your address/temptoken pair for resale to spammers and for that matter an endless series of sales pitches and "specials this week" emails.
The two types could be made indistinguishable, so if you did a lot of business with somebody you could always give them a permtoken. Maybe make the list of permtokens and associated list of correspondents have a sort of "revokeability." I.E. if you don't want to talk to them (get emails from them) anymore, just take them off the list for that permtoken before regenerating it.
Mails coming in with expired or bogus tokens could be blackholed or bounced.
I admit I haven't thought it all through... and I've probably expressed the idea clumsily here. Does this sound at all practical though? Seems better than any "pay for play" 2-tiered email system to me. It probably has some gaping holes I haven't thought through.
We might need a "sync" functionality for those who use multiple email clients (on several machines).