If you're using <some-alias>@user.example.com nothing says that [email protected] has to be a valid delivery address. If I read the article correctly in fact, that is the case in their implementation. So it's not possible for spammers to guess an unaliased email address.