One address, read by one person. No form, no ticket number, no autoresponder.
Requests sent to an endpoint are held for thirty minutes and then dropped. Endpoints are unguessable but not secret — anyone with the URL can read what was sent to it, so do not post real credentials or customer data through one.