If this becomes popular, what stops spammers from figuring out that the part before the last dot in the username can be anything? A lot of shady folks already

If this becomes popular, what stops spammers from figuring out that the part before the last dot in the username can be anything? A lot of shady folks already know about Gmail's plus-addressing trick. If I were a spammer and I found that foobar.username@mailhero.io didn't work, I would just try bazbaz.username@mailhero.io. Perhaps you could set up the system to only accept aliases that have been explicitly configured. But that would make Mailhero a bit inconvenient for regular users, since they would have to add an alias before using it elsewhere. Another possibility would be to add a big button in the dashboard that automatically generates a plausible address (e.g. barack.hillary.trump@mailhero.io) with no connection whatsoever to your regular username or other aliases. No need for the user to decide what alias to use, and no way for a spammer to figure out a working alias.