Indeed. Email forwarding has been broken for years. I don't allow it on any MX I run. Even with the best defenses, it's too risky to allow users who are spam magnets to harm your server's reputation.