1. Default Address - check that it says "Send all unrouted e-mail for: (yourdomain)" is set to Discard with error to sender. This means that mail that is not sent to an address you have set up will not reach you. It'll stop email@example.com so you should only get firstname.lastname@example.org.
2. Choose Email Authentication
DomainKeys is an e-mail authentication system that allows for incoming mail to be checked against the server it was sent from to verify that the mail has not been modified. This ensures that messages are actually coming from the listed sender and allows abusive messages to be tracked with more ease.
SPF will specify which machines are authorized to send email from your domain(s). This means that only mail sent through this server will appear as valid mail from your domain(s) when the SPF records are checked.
Go back to the Mail section and enable Spam Assassin also
There is a Help Icon in the upper right corner of your cpanel for help with features.
3. OutGoing Email - please do not use the server for mass mailings. Use your own ISP (Internet Service Provider) or better, use a service such as Constant Contact, YMLP, Vertical Response, etc. Then you have in place the very important compliance with CAN-SPAM act. Your subscribers should have an opportunity to opt out.
4. Auto-Responders please consider using it only in the event of urgent matters. Perhaps being away for a short period, not thanks we'll be back to you.
For two very simple reasons
#1, 99% of the people know its an auto-responder and feel it is impersonal.
#2, once that spam hit's your auto responder it has happily discovered a valid email address and you're going to get it again and again ....
5. If you choose to use Box Trapper, you should know that your recipients will need to be 'approved' and some may feel that this is a turn-off to corresponding with you.