If my best friend from college wants to track me down and send me an email, I want him to be able to do that; but I don't know his email so he's not on my whitelist. So, we need a solution to this problem.

Publish/share whitelists. You haven't whitelisted your friend, but somebody has. Find 3 people who say "this guy is not a spammer," who themselves (recursion alert!) are not spammers.

In other words, guess their spammer rep the same way you guess whether or not to use an OpenPGP key that you haven't personally certified.