Similar setup for me: separate addresses for external parties, which BTW, helps phishing recognition too, because e.g. a "note from my bank" to an address I did

Similar setup for me: separate addresses for external parties, which BTW, helps phishing recognition too, because e.g. a "note from my bank" to an address I did set up for some shop cannot be real. And those abused addresses can be deleted from /etc/aliases to render them void. Besides that my postfix server is configured to reject connections, where the sending site does not have a reverse DNS mapping. Worked twenty years ago, is still useful today when I check my logs.