I imagine some inbound email could be whitelisted automatically, from some authentication tech. If I sign up for mailings, some app (email? browser) can give a one-use cert or id that can be passed back in email headers. If that company sells my email, I can block further emails from that source. It doesn't seem hard.