Assuming a password manager is used, even jfav0ohjau4gvncgan19@domain should be OK.
On the other hand, I might just be overthinking it. It could even look suspicious to customer support, or is that again just overthinking?
Also, there already will necessarily be some predictable ones, such as work@domain, although servicename@domain would provide even more possible matches.
I’ve heard (from one person on the internet) some servers might scan for presence of catch-all by sending e-mail to long random string e-mail at the domain, and then potentially sending spam to anything if it doesn’t get rejected.
No idea.
My first thought would be that sending an email to every possible random string would be a quick way to get flagged by whatever big city backend blacklisting goes on. If I were trying to set up my own email server for my own domain, unless there’s some rule that says I have to, I’m not sending a no-such-address message back. Making a success and a failure look different to the attacker (which I’m going to treat spam senders as for the purposes of histrionics) is giving them a signal for free.