I think that number 3 is the best option. The others are too limiting, in my opinion.

Actually, there might be another way.

You bring up an excellent point about people creating multiple accounts to creep on people. Would it be possible to ban someone's IP? Ultimately you can only do so much, ya know? But it's still better to try and do as much as possible in order to help someone out.

I think that the idea of whitelisting is an excellent choice though! That would resemble how twitter has protected accounts that require the user's permission to follow them.