I whitelist using regular expressions (specific prefixes mostly). Gibberish and random localparts are unlikely to match those, it effectively never happens.