[jrootabega]

This will work if the sender is just incompetent or uncoordinated. If they want to keep sending you spam against your wishes, they will just normalize back to your base address. you could keep a dotted form that you only share with entities that you trust absolutely, but that seems fragile