First thanks for making such a wonderful project.
I came across this idea today and I wonder if it would be useful.:
For the whole account (or each disposable address), the user can specify a 2nd forwarding address. (Might need a switch on each disposable address).
All messages that are going to be eaten, will be forwarded to this 2nd address instead.
This won't add much burden to the server (as eaten log will). While it should assure paranoid people that no important message gets "eaten" and is gone forever.