When mail in the queue is undeliverable, Postfix will log why, and will create a bounce message, and will remove the undeliverable message.
When the bounce message is undeliverable, Postfix will log why, and will create a 'double bounce' message, and will remove the bounce message. When the 'double bounce' is undeliverable, Postfix will log why, and will remove the 'double bounce' message. This process stops after three steps, to avoid an infinite loop or even an email explosion. What explosion? Each of the above steps may result in one message being sent to an alias with multiple recipients. That explosion. The above process is documented with copious logging. My definition of 'silent' differs from yours. For testing, 'dont_remove = yes' will keep removed mail, but it has poor usability, as the operator gets to read everyone's email. Wietse