I don't know if Exchange will handle this, but I enabled user suffixes. I use a different suffix for each newsletter, marketer, etc. Instead of
firstname.lastname@example.org, is use
email@example.com. If one of these addresses becomes a spam source I create an alias that fails delivery. The alias i use is
:fail: Unroutable addess.
Users can create as many aliases as needed this way, and legitimate email is delivered. Blocking addresses is relatively easy. You will need to check how to implement both the suffix and alias mechanism in Exchange. Aliases need to be checked before suffixes are removed for this to work.