"An address nobody has created is treated differently", the ALLOW_UNKNOWN_INBOX flag is the one config choice I'd actually lose sleep over here. Leave it open on a catch-all and you've built an infinite free inbox generator for anyone who knows your domain, not just your own agents.