The tl;dr version: I use a whitelist approach. Any email from a
new address automatically gets a quarantine tag, and no inbox
tag. The sender gets an email asking to confirm their email
address. Once they do that, they get into a whitelist and all
their emails that have the quarantine tag are switched over to
having the inbox tag.
I have Emacs keybindings to:
1. Quarantine a person who got into my inbox and shouldn't have
(i.e. "-inbox +quarantine"). It also runs a script to remove them
from the whitelist.
2. Dequarantine: The exact opposite of the above.
Since it was built using notmuch, I thought you'd be interested.
Love is like Pi: Natural, irrational, and very important.