Anything at a custom domain that doesn't look direct to an individual (e.g. not [email protected]) is a big hint to spammers that the owner uses a catch-all and thus any address will get the job done. I suppose you could go with a whitelist for every random address you give out and blacklist the ones that misbehave, but that's a lot of work and, since every company misbhaves these days, including entities like banks, you'll likely miss emails you actually need.

I don't care much about spammers. The filter at FastMail is good enough. What I care about mostly is to make automatically correlating my identity between different websites harder.

> you could of course just use <random string>@yourdomain for every login

You could also use the hash of the domain name with a secret salt value. Then if you somehow lost your login info, you could still figure out what your recovery address was if you still knew the salt.