That's obviously the better way. But it's not my server, so I'll have to see what they support.

They have SpamAssassin, but you can't use it if you have a "catch-all" address set up. That's their term for a wildcard match to send *@domain.com to a common inbox.