When I started doing this, many years ago, I fully expected to see spam coming to some of these addresses. I was pleasantly surprised to find that, so far, not one of these addresses has been compromised. All my spam comes to addresses that are essentially public, or random names, as I use a catchall.