I use a catch all on (several) domains and have received a stunning 5 spam-mails within the last 2 years.