For some years I am thinking about making a similar service, but as a receive only box with a twist. I wanted aliases to be done on domain level and tunnel encrypted traffic straight to user's device as the TLS certificate for e-mail server would reside on user's device. Thanks to that I wouldn't need to store anything and I wouldn't be able to snoop anything (at least without being seen). That way user's phone would be their e-mail server. When an address would get compromised it could be filtered on the DNS level before it even would reach the user's device. There are lots of challenges that way that I have ideas to overcome somewhat, but yeah I would trade one kind of complexity for the other.

My worry for addresses in style user-alias@example.com is that alias is not random by default meaning someone can imply what addresses you have based on a single address. At the same time this keeps things simpler for users, because otherwise it gets janky and you of course need a mapping between a random address and what it means as well as a wanting for password manager integration or a browser extension at least.

I guess it is a balance, but by not allowing the perfect become an enemy of the good your service works right now. I acknowledge that you might have struck the perfect balance so please don't take it as a jab at you. I see that you have this "Patented Spam Filtering", so cheers! :)