Noted. My workaround is using a randomly generated mailbox address with aliases and identities on top. But yeah, I can't imagine a solution at the moment other than locked down clients.