The biggest problem with email spam-wise is that it lacks any sort of user/mailbox authentication. The only useful signal in the meta-data is the origin domain. The protocol assumes the domain owner does some form of access-control and every message coming from the domain is equally trusted. If one has been communicating with alice@foobarizer.com and receives an appendage enlargement ad from bob@foobarizer.com they could be reasonably confident that Bob's account was compromised and communicate that out to Potmaster and Alice to be handled internally.

Of course this assumption is fully invalidated by open-access mail service providers: maintaining communication with xXx_kitty_slayer_xXx@tepidmail.com tells absolutely nothing about sincerity and authenticity of messages from DrJohnSmith@tepidmail.com. Not only there's roughly zero correlation, it could be argued that correlation is slightly negative if one does not expect out-of-the-blue contact attempts. Funnily enough, with the critical mass of non-spam migrating to providers, it becomes sort of positive signal, fueling feedback loop: even if the majority of spam came from gmail, messages from gmail would still be more likely to be non-spam than messages from rncrosoft.com, because most non-spam comes from there too.

On top of that, there's a lot of soft-spam. Companies will happily send out critical contract-related information and unwanted-unasked advertising from the very same domain and even the same address. The big providers are not shying away from selling shielding services to spam agencies.

That "someone" could - in theory - require pgpgpg signatures attached to messages and have origin-based filtering/ranking, but good luck convincing people to set up their gmail/outlook to even generate the signature, let alone publish it reliably/revocably. At the receiver end, your only reasonable bet is filtering/ranking the content. It's probably not a strictly uphill battle, but you definitely need significant amount of volume and tagging before your models become good enough and it stops to the case.

In reality, even if it sounds a bit ironic given above, the best route to fixing this is self hosting, especially in the cases where your messages are needed. The more people try to send mail from their self-hosted instances and insisted that it was the problem of the other end to complain to their service providers if they do not receive the messages, the less hegemony the cartel providers would have. And maybe we could have some sort of client auth for email.