On the same note, they can just construct <random chars>[email protected] and email sent there will be forwarded to you as if that's the custom email address you sent out.