Like Lissette says, you can require a proper match on inbound Internet email addresses, but there is another opportunity here which you may like to consider.
Say you have a user named fred.bloggs@example.com and he also gets mail for fred@example.com and bloggs@example.com, create a mail-in database and use fred and bloggs as mail in names for it.
The real Fred will never see these messages addressed to fred@ or bloggs @ and they will all land in your mail-in.
You can then -
- report to Spamcop or like places
- review the headers and identify sources of unwanted email, then either choose an RBL that blocks them (e.g. korea.blackholes.us) or block these addresses locally
Long term this reduces the amount of spam your users get significantly and the volume received by the spamtrap mail-in also diminishes.
I have a spamtrap db here with c. 50 aliases (including first or last names of real users here) and it now gets hit only 2-3 times per day.
HTH
Chris Linfoot
http://chris-linfoot.net