Which still doesn't make sure it _is_ little jimmy sending the card.
If envelope-from is set to postcards(_at_)crummypostcards(_dot_)com, that
domain
will have to deal with bounces, not jimmy(_at_)bitshift(_dot_)org
Which is exactly how it should be.
I get about 75 bounces every day just from misconfigured virus
scanners bouncing mail I never sent.
The info that goes into those web forms is not authenticated, it
should not cause any bounces to go anywhere other than to the
site sending the stuff.
I often use potus(_at_)a1(_dot_)eop(_dot_)gov as the from address in those forms
I bet many others do similar.
Phill