I have a test system running and after a few days, I already have close to 500 users automatically entered into the database. It looks like it is creating a user for any address that is included in the incoming email.
Many of our incoming mails are from distro lists where the senders don't have enough sense to BCC the list. I even see a user created for "undisclosed-recipients" with an email address of "@"