I had the same issue a while back for one a few of my domains. I did a combination of things.
1. I created a default catchall named: catchall
With this, the only mail that made it to the clients were ones addressed specifically to them. I also made sure the spam was enabled in ispconfig.
2. Second client didn't want a catchall so I set up rules for their email client that basically said "If the to: field is not email@example.com
, or does not contain the email put it in the folder called 'possible spam' "
With the second solution all the mail was delivered but his inbox was clean with only email to him specifically... Then the folder Possible Spam oculd be looked through by him manually to see if anything of interest was in it...