This is a "big fleas have little fleas" scenario.
Years ago, a spammer took to using my domain name with ever more fanciful names at it. I would get "undeliverable" messages to things like fe60b4ec.70081@...
Because that domain is set to "catch-all" mail, I got them.
Eventually, he stopped. But meanwhile, junkmailers started sending Viagra etc ads to those same random addresses.
In the end, I had to set up "forwarders" for those addresses, to send the messages into oblivion rather than to me.