It doesn't have to be a real domain or a potentially-valid address. I will usually use something like spam@gmail.com, root@localhost, or info@TheirWebsite.com.

It doesn't have to be a real domain or a potentially-valid address. I will usually use something like spam@gmail.com, root@localhost, or info@TheirWebsite.com. Last one likely gives them a taste of their own medicine.