If you're using <some-alias>@user.example.com nothing says that user@example.com has to be a valid delivery address. If I read the article correctly in fact, that is the case in their implementation. So it's not possible for spammers to guess an unaliased email address.