I own a domain name that is a generic word but is also an one-off of a medical company (and a very "likely" typo). My catch-all mailbox has received an insane

I own a domain name that is a generic word but is also an one-off of a medical company (and a very "likely" typo). My catch-all mailbox has received an insane amount of highly sensitive medical records over the years. Most of these mails were coming from employees of the company itself, not external correspondents. I have since modified the catch-all mailbox to reject mails from the medical company, so they get a bounce message. This has not reduced the number of messages, but at least they will know something went wrong... People are not very careful, even with highly sensitive data...