refuse to add an address when its localpart contains the domains catchall separator, or when its canonicalized address (e.g. lower cased when case-insensitive) is already present, and check at startup as well

such configurations are certainly errors, but were silently accepted and highly
likely not doing what you may have hoped. i suspect no one has configured mox
this way.

mox-/lookup.go

@@ -15,7 +15,7 @@ var (
 	ErrAccountNotFound = errors.New("account not found")
 )
 
-// FindAccount lookups the account for localpart and domain.
+// FindAccount looks up the account for localpart and domain.
 //
 // Can return ErrDomainNotFound and ErrAccountNotFound.
 func FindAccount(localpart smtp.Localpart, domain dns.Domain, allowPostmaster bool) (accountName string, canonicalAddress string, dest config.Destination, rerr error) {