So my spam folder is flooded with a bunch of junk coming from various “info@whatever” email accounts.

Most likely, these are full blown email mailboxes set up for some kind of easy handling or processing, but not actively monitored or secured and were compromised.
If you’re looking to create an email address that’s just going to be used to re-direct messages, or for incoming only, don’t bother setting up a full blown account.

Services like Office 365 give you ability to create email addresses called “distribution lists”.
This email address will handle incoming mail and forward it to the appropriate persons in your organization.
You can also use a “shared mailbox” that can allow you to not only monitor it like a second account, but also store the emails, as a distribution list will only forward, not store.

There are some other features each can do, but the key is to restrict them.
If no one will be sending as “info@”, don’t give anyone the right to.
For shared mailboxes, disable their ability to sign in, since you’re not supposed to be signing in directly to it anyway.

Using those 2 types of email accounts gives you some incredible control and accountability.
Handling things like “info”, “sales”, etc., like this helps not only organize your communication flow, it helps keep your business secure.
The icing on the cake, those types of email accounts are free in Office 365!

Other emails services can offer similar features, some don’t offer anything except basic email accounts.
Talk to your IT provider/person or email provider and ask if they can help set those kinds of things up for you.