thankfully that is a special mailbox for spam, I sometimes like to come through the emails and see where they submit the data, and maybe submit some data on my own, plus report the issue to website owner/hosting

it depends on your email provider/server, search under term “catch-all” or alias. I’m using a self hosted email on hestiacp, which have a option under domain email settings

At my instance I did setup a email wildcard (receive emails from any address on that domain which don’t already have a account) and I get a lot of phishing and scam emails, most of them are send “to” /c/meta@femboys.bar, as link to this community is linked in sidebar, but I also seen emails “send to” random usernames

So yeah, It is happening, i wonder how bad it is on larger instances