Mystery solved, I think: I have been receiving spam addressed to email@example.com, rather than to any particular mail account on my domain. Had the messages been addressed to any account on my domain, they would have been caught by my junk mail filters, rules that apply only to my domain, not any other domain!–Duh! I am an idiot not to have realised this before!
The curious thing is that I do not recall ever having used ‘firstname.lastname@example.org’ in any of my correspondence; so I do not know how spammers got hold of that address.
Not happy! >:-(