When I explain to my clients the security issues around email spoofing, I often explain that emails are like regular mail. Anyone can write Jon Doe on the return address, but that doesn't necessarily mean that Jon Doe sent it.
Why can't an email server be setup to receive the following fields over a TLS session:
hash of email
And return True if an email was sent that fits those values.
After every email the client receives, it can reach out to that email server with those values. If the client gets a return of False, just drop the email.