AFAIK that's more or less how it works today as a practical matter. The law recognizes this situation as an affirmative defense, but does not make it impossible to be charged.
To be an affirmative defense it has to be reported immediately or destroyed, constitute three images or less, and not be sent to anyone [other than law enforcement]. Interestingly, NCMEC doesn't necessarily count for that -- if you find yourself in this situation and you want to report something, call your local police.
I'm sure smarter people than me have sussed this out and can explain why it's a good thing, but it sits wrong with me. We can put the subject matter aside for a second: I don't think I could convict someone for having something happen to them, regardless of what the law says. Let's say drug possession was a strict liability law (and maybe it is for all I know). Finding a baggy of meth on the corner of a farmer's lot would mean that, technically, he was guilty of possession and had to prove that it wasn't really is. That's nuts. And looping back to the subject at hand, if the only evidence that someone possessed CSAM was their email inbox, without proof that it was solicited? They want me on their jury.
There should never be a circumstance where someone can't report something that happened to them to the police without a legitimate fear of being arrested. That's bad for the person, and it's bad for society.
But if their hard drive has folders grouped by age or something, prepare the solar catapult.