On the same note, they can just construct <random chars>[email protected] and email sent there will be forwarded to you as if that's the custom email address you sent out.
It would be easy enough to just prepend something random to the bare email's anyway, or to replace the random bit with every e-mail sent. So you can still spam mailhero users.
If anyone from Mailhero is here - why don't you block the bare-naked emails? If this becomes popular then marketeers can just search for @mailhero.io addresses and strip off any string followed by a dot so that they can spam you.