I imagine it won't take long for spammers to recognize that Heartbleed is an ideal way to do phishing. I am thinking of ways to mitigate the phishing risk, I mean just this time for the heartbleed bug, not generally.
End-users will likely receive many official emails asking to go to a website and reset the password. Maybe this even becomes advertised in radio or television. If spammers do a good job, they can easily slip in and have a high success rate.
What can I do as a server administrator (particularly hosting IMAP servers) to filter specifically the heartbleed spam and let official mails through?
I already have general spam filters applied and grey-listing enabled. But if I had e.g. a more complete list than the top 500 vulnerable sites, it would be possible to only forward mails sent by those domains and disallow others. Of course that list should be confirmed by some more official organization.