> e.g. if prefix.suffix@example.com is published online, they will try prefix@example.com and suffix@example.com That is likely someone trying to programmatica

> e.g. if prefix.suffix@example.com is published online, they will try prefix@example.com and suffix@example.com That is likely someone trying to programmatically circumvent filtering based on catch-all-ish naming conventions, like gmail's support for usernamepart+anythingelse@gmail.com all going to usernamepart@gmail.com and similar facilities offered by other email services. Sending to <something1>@dom.tld and <something2>@dom.tld as well as <something1><puntuation><something2>@dom.tld seems like a potentially useful heuristic. Though it may create excess false addresses, if spammers care about that sort of thing (that depends on whether the chance hit on real addresses is worth the need to transmit many more messages that will fail/bounce and maybe help train spam identification systems).