I don't think it will lead to spam because you must know the email/domain combination for it to work. Any invalid pairing will simply not send an email. And, as you know, CIRA does not publish individual data in WHOIS so in theory, the only people that should know the correct pairing is the rant or admin contact.