Not true, there is a distinction between your reply address and any secondary addresses you have configured on the mailbox. Still, as far as I know that’s not something they should be able to see from outside your email server. You are setting up aliases on your own server right, not using some third party as an intermediary? Using a third party intermediary would possibly be something they can see from the delivery routing.

It’s most likely that this is just them shitting on you for using an “untrusted” provider. Most big sites and email providers are really getting stingy lately with who they’ll accept email from and what is accepted as a valid email domain. There’s also a big push for properly configured SPF and DKIM records that aren’t set to allow spoofing sender domain. It’s combining to cause a lot of issues for self hosters lately, and also for companies that have vendors who insist on sending email from the vendor’s servers but appearing as from the company itself.

How would they even detect that? Blacklist common alias providers?

So a redirect instead of alias? E-mail alias is the address+alias@… thing.