Just got a bad surprise...

Two domains, one "true" and another one aliased to it.
Aliasing was done following the wiki way.

Problem is domain aliasing (wiki way) uses CatchAll...

So, you hit the (standard)CatchAll issue, ie any email address of the aliased domain is considered to exist...

And the MTA has to deal with the huge amount of spam that comes in this way (even is smtpd_reject_unlisted_recipient is set to yet)...

Bug 24604 - Domain Alias breaks the SMTP Callout