[JeremyNicoll]

I currently have just under 900 defined email addresses. I hand out separate ones to every company and personal contact I have. It means that when - inevitably - an address gets compromised I only have to change the address that that person/company uses for me and block any dross that comes addressed to the old address.

There are regex-detectable patterns in the form of the addresses I use, so filtering sets of related addresses is easy.

Truly 'throwaway'/one-off addresses include the date they were first used on, so replies coming in more than a couple of weeks after that date are automatically suspicious.

Although I do quite often open spam emails (in plain text form) to see what's in them, one of the biggest protections against phishing mails etc is that I know for certain that an email purporting to come from a specific company is fake, if it doesn't come to the right sort of email address. If it does come to the right sort, or even the right specific address, I still treat it with caution, but I may at least look at it (in plain text) before discarding it.

The scheme has disadvantages. When someone asks "what's your email address", I have to explain I hand out individual ones ... and I'll be in touch. But that's not a hardship - if they're a company/person I really want to be in contact with I/they can wait. It's also a nuisance when eg I have emails going to a set of people - say an accountant, lawyer, and family members all of whom already have separate addresses for me.

These multiple addresses are with - currently - two mail hosts, and three domains. Many of the addresses are what some companies call aliases. On the other hand two of the domains also have subdomains and some of the filtering is on the servers. There's only four mailboxes that I actually check every day but some of those have many different addresses' mail routed to them.