[stevekemp]

When I used wildcard support I got spam to :

[e-mail]

[e-mail]

So I'd be tempted to think that my address had been leaked from there, but I also got other messages sent to addresses like:

[e-mail]

[e-mail]

[e-mail]

In the end I figured that I was just dictionary-attack, and optimistic senders, and I could never be sure that a particular company had actually leaked an address.

These days I just give steve/at/steve.fi to everybody (I moved countries, hence the new TLD). I ported over all the aliases that had received email in the past five years and started rejecting unknown local-parts. That stopped badbots from mailing things that seemed like poorly-scraped message-ids "[e-mail]".