I started checking the postmaster@wfu.edu mail.
First I asked people on SAGE’s (members-only) listserv whether they check their postmaster mail. The response was an overwhelming “some human must read this mail.”
A few hours later, I got Thunderbird set up with some rules, like “immediately delete any mail from MAILER-DAEMON where the subject contains ‘user unknown’”.
The problem is, lots of people have OOO (out of office) messages, which (probably despite some RFC) reply to postmaster. Those aren’t easy to filter, but so far there have just been 5-10 a day, so I can delete them. There are also some noisy cron jobs, but only once per day and only a few messages.
Lo and behold, I got the first legitimate message yesterday, from someone who thought they got spam from us. The mail headers were forged, actually (the spammer used a WFU address but mail really came from another place) so I let them know.