I keep them locked and change the passwords once in a while. Basically, once my address starts getting a ton of spam and scams per day, I stop using that address. Only the one I’m currently using shows notifications. The rest only show when there’s a login.

I don’t change too often. I still only have a handful.