I've started doing this about a year ago, but I haven't nailed down an easy way to blacklist addresses from my catch-all. Do you know of a painless way to do that?

Don't use a catch-all. List specific allowed addresses, and remove them (after reporting) if they become spam sources.

In fastmail, rules for specific addresses take priority over catchalls. So if I have a catchall and tell it to bounce emails to spamco@, the bounce rule applies properly.

I share my domain with my parents, so I use [email protected]_domain.tld instead, whereas XXX is replaced by the service I sub to. That gets routed to my inbox and I have some server rules that sort them in sub-dirs.

For more shady stuff I have some throwaway mail at some free mail provider.