Backscatter spam and google apps

Sometime in the last week or two, I started getting huge amounts of backscatter spam to my google apps domain. Looking through the settings, I found that a nickname "*@mydomain.com" had been added to my account, and the accompanying "remove" link didn't work. As you might guess, this really isn't a good thing.

Here's how to fix it:

Dashboard -> Service Settings -> Email

There's a setting for "Catch-all address". You can create a catch-all address if you want, but I chose to discard email unless it's to a valid user.

It looks like the recent back-end work at google changed the default behavior.