To ensure known email addresses are not sent to the catchall mailbox a security group is created. This security group must contain all known users.