To the my inner armchair security enthusiast, a good solution looks like this:

  On incoming message, check one thing and one thing only: is the sender in the contact list? If YES...
     + Run the message through BlastDoor and continue as normal.
  If NOT…
     - Stop all non-essential parsing immediately.
     - Continue with a flow similar to modern e-mail clients (To increase your privacy, we have blocked some elements of this message).
     - Only continue normal message parsing if the user explicitly consents.