so I figured Postfix must be caching verification results somewhere.
Indeed, there is a /var/lib/verify_cache.db and it contained the 7 bouncing addresses as well as the 15 rejecting addresses. But the bouncing ones appear to have been verified as OK in the past. Removing the database and restarting Postfix fixed it. Thanks, Pim