[delayed]

Very few people host email, and even fewer in the same VM as where their website is. I would be surprised if this is the case for even 1% of the sites, and attackers probably are exploiting sites by the hundreds, not babysitting and monitoring the email traffic of one of them to quickly delete any vulnerability reports coming in

This works a lot of the time though (include info@ as well). In whois data you can also always find an email contact for abuse notifications

(To be fair, I was a bit annoyed by a recent AI bro spamming about fifteen such prefixes on my domain with a false positive vulnerability report. The PoC did not work and the field they were injecting was already correctly escaped. But it is effective if you're facing a bulk problem like this I suppose)