The NDRs generated by non-existent email addresses are very important. How else would a sender know they have made a mistake and addressed an email incorrectly?
Here is an article about why NOT to use catch all addresses:
http://www.allspammedup.com/2010/05/why-you-should-not-use-a-catch-all-email-address/
If you're worried about directory harvesting attacks (where attackers send lots of email to your network and use the NDRs to determine valid and invalid addresses) then you can combat that with any email security product that includes directory harvesting protection.
GFI products do this.
Or you can do it with Exchange 2010's inbuilt security features, by configuring the tarpit interval. Read this article (scroll down to the part about tarpitting):
http://technet.microsoft.com/en-us/library/bb123891.aspx
You can read more about directory harvesting here too (refers to Exchange 2007 but applies to Exchange 2010 as well):
http://www.allspammedup.com/2008/12/protecting-exchange-server-2007-from-directory-harvesting-attacks/
- but it doesnt apply for mailboxes that doesnt exists.
– Itay Levin Dec 20 '10 at 18:46i have a lot of users (10K) in my application - and i don't want to create a mailbox for each user.Do you mean you have a web-app which is sending out emails or what ? Please clarify as normally people would have MailBoxes, Mailcontacts in Exchange. – Mutahir Dec 21 '10 at 12:48