Earlier quoted context omitted.
If you do this you immediately get thousands of emails a day from bots trying common first names etc. Much better to maintain an explicit list of names you're currently allowing.
Surprisingly not. I have catch-all emails on several of my domains, and rarely get common name spam. I've blacklisted less than a dozen names on my domains in over 20 years.
So far I think he's returned at least two domains to their previous owners, because letting them laps was a mistake.