I do this too, but with the domain name instead (eg [email protected]). That way anything that doesn’t pass the simple glob (.) gets filtered off to the admin account for later checking-over.