With "suspicious" sources step 1 confirms the address to them, which allows them to see it. Delaying step two requires book keeping. Immediately blocking is l

With "suspicious" sources step 1 confirms the address to them, which allows them to see it. Delaying step two requires book keeping. Immediately blocking is low effort with effect. In few cases, where senders seem to be "proper" companies I do a GDPR request. Sometimes they provide valuable information about address brokers etc.