I think the biggest problem is that "normal" people have no clue that email is as insecure as it is. They trust that if an email says it's from a specific address, it must be.

The issue has to be fixed on a system level so spoof emails are impossible, because thats how most users think it is already.