One thing that stands out in this story is that we don't have an authenticated email system that most people are willing to use, and this causes real problems.
If the largest players could agree on one standard for secure email, I bet lots of people would transition overnight.
The issue has to be fixed on a system level so spoof emails are impossible, because thats how most users think it is already.