Don't use a catch-all. List specific allowed addresses, and remove them (after reporting) if they become spam sources.