You could do away with the 5ct part of this, just by requiring a special header to get around the api part. Then you funnel all that junk into a special folder

You could do away with the 5ct part of this, just by requiring a special header to get around the api part. Then you funnel all that junk into a special folder (black hole) that you can either ignore or check if you are expecting a legit request for your attention. The more I think about it, the more I love this idea. All email that shows up in your inbox is there because you have to explicitly allowed it.