Don't use a catch-all. List specific allowed addresses, and remove them (after reporting) if they become spam sources.

In fastmail, rules for specific addresses take priority over catchalls. So if I have a catchall and tell it to bounce emails to spamco@, the bounce rule applies properly.