I use SimpleLogin; and for the most part they don't show up like this most of the time.
That being said; I also don't deeply do investigation unless the emails being sent from the alias vary from that alias' purpose.
Typically as long as the emails remain from the same relative sender (From:
field in header) and the subject matter of the emails do not materially differ from what I initially get on the alias; I don't really fiddle with them.
But since the alias typically is a fixed sender; I also have them configured to include the actual From:
header in the alias From:
fields. This allows me to quickly block with granularity from my inbox any stray emails that might wander onto an alias without making it necessary for me to kill the entire alias. (Assuming the alias is still in use and worthy of preserving)
But then again I don't have nearly the spam problem that most do. I have segmented inboxes for various needs; and my GMail catches most of my crap being the biggest inbox. Between SL and GMail spam filters alongside of additional inbox filters I have setup there; most of the spam I get is generally funneled to the correct place and spam is minimal.