I've started doing this about a year ago, but I haven't nailed down an easy way to blacklist addresses from my catch-all. Do you know of a painless way to do that?
Don't use a catch-all. List specific allowed addresses, and remove them (after reporting) if they become spam sources.
In fastmail, rules for specific addresses take priority over catchalls. So if I have a catchall and tell it to bounce emails to spamco@, the bounce rule applies properly.