I’ll try to add more later, but it is believed that multiple times, a bug in some random API has allowed for the “hidden” Apple account to be revealed because they resolve hide my emails to the original internally. Using a separate namespace would be the universal fix.

A mitigation for the cause of https://www.404media.co/apple-hide-my-email-vulnerability-re...

https://news.ycombinator.com/item?id=48559935

If you dig more you could find the bug, but AFAIK it was that if you sent a large attachment, the bounce email would contain your real address.