I do that in a fine-grained way with my personal domain: I receive mail addressed to any user at the domain. I never give out the same address twice. I can filter mail based on the "To" field, and always know how senders ultimately got my address. It works out because spammers never send mail to random other users at the same domain; I think trying unconfirmed users would be a quick way to get themselves blocked by common spam filters.

A fun thing I found this way: Samsung won't let you sign up for an account if the string "samsung" appears in your email address. Must be annoying for [email protected]!