It shouldn't be this easy to use someone else's email address.
>It shouldn't be this easy to use someone else's email address.
This though, seems hard. I don't think this is a "security" thing per se (though I dearly wish there was a modernized "email" system built with modern crypto from the ground up). But for any sort of communications at all it seems like there is an inherent tension between how low friction one wants for the world to communicate vs protection. Like, there is nothing stopping anyone from doing a pure whitelist system for email right now. I even do in fact do that for a few accounts like specific ones for client contacts, only active client addresses will be accepted everything else is blackholed. Those obviously receive zero spam or misuse of any kind [0]. But obviously the tradeoff for that is no new potential clients could ever "cold call" it either. One could imagine technical solutions like "only accept stranger email from accounts with a signed ID" or "vouched for by known address" (ie, WoT) or "only address with a signed time token >N from providers X, Y or Z", or some kind of challenge/response, but all would have privacy tradeoffs, complexity, and still wouldn't inherently do anything about honest mistakes.
We could have more powerful options for this, but it'd still involve subjective tradeoffs between how open to new communications one wants to be vs cutting down on noise. No one right answer there.
----
0: Forged from fields are of course possible but in practice someone would at the least have to know which handful of the total planetary email addresses were whitelisted, never mind flags that show up in the headers from that
Ask me how I know :( PP money was not recoverable that one time my ex sent it to the wrong email address.
Thankfully it was only $500 bucks or so, not $45,000.