Started running my own email server about 10 years ago for essentially this use case. Every entity I need to give an address to gets a unique, randomly-generated one. I figured this would let me spot the leaks.
After roughly 1000 addresses handed out, surpisingly only two sources end up receiving spam: 1) addresses that I've posted on public forums, and 2) the address I use for patches to GNU software.
After roughly 1000 addresses handed out, surpisingly only two sources end up receiving spam: 1) addresses that I've posted on public forums, and 2) the address I use for patches to GNU software.