You have to strike a balance if you want to enable contact with the outside world. Sure, uncompromising data protection is possible, but then no one will write to you because most people don't make the right tech choices. It's not like every initial inquiry contains a state secret. For more sensitive content, you can always resort to other means. This all-or-nothing attitude is simply not realistic.