You're spot on with the VERP suggestion, but:

(well, DSNs are a sort of standard, but nobody follows them)

Actually, DSNs are overall very popular - just writing a simple DSN parser will recognize a large majority of "bounces".

There is one thing that's standard, however---where the bounce messages go. Bounce messages are always sent to the envelope sender of the message.

Not entirely true.

Bounce messages are supposed to go to the envelope FROM address, according to the spec, but they don't always - sometimes, they go to the header From: address instead. It's not a lot - about 1% of bounces, in my experience - but it's some.

Qmail rocks - but to catch ALL bounces, you also need to consider those that are directed to the header From: address as well.

Peace,
-McD