Both you and jhourcle are right. Relying solely on a whitelist is not the way to go. What I was suggesting was to include that as part of a solution.

I know that with Thunderbird, even though it's using a whitelist, I go through every time I d/l e-mail and see if something got filtered that shouldn't have. The program's learning is part of the solution as well, however it may be beyond the scope of what the op intends.