"You never had this happen?" I have had a catch all email for over 3 decades and spammers practically try everything under the sun for the local part of the email address. It's like the usernames you see in the "random background ssh noise" of the internet.
On more recent decades I have seen bots even split by separator, e.g. if prefix.suffix@example.com is published online, they will try prefix@example.com and suffix@example.com.
> e.g. if prefix.suffix@example.com is published online, they will try prefix@example.com and suffix@example.com
That is likely someone trying to programmatically circumvent filtering based on catch-all-ish naming conventions, like gmail's support for usernamepart+anythingelse@gmail.com all going to usernamepart@gmail.com and similar facilities offered by other email services.
Sending to <something1>@dom.tld and <something2>@dom.tld as well as <something1><puntuation><something2>@dom.tld seems like a potentially useful heuristic. Though it may create excess false addresses, if spammers care about that sort of thing (that depends on whether the chance hit on real addresses is worth the need to transmit many more messages that will fail/bounce and maybe help train spam identification systems).
On more recent decades I have seen bots even split by separator, e.g. if prefix.suffix@example.com is published online, they will try prefix@example.com and suffix@example.com.