Like whitelist and blacklist entries, the addresses are file-glob-style patterns, so "firstname.lastname@example.org", "*@isp.com", or "*.domain.net" will all work. Specifically, "*" and "?" are allowed, but all other metacharacters are not. Regular expressions are not used for security reasons.
The sequence %u is replaced with the current user's username, which is useful for ISPs or multi-user domains.
Multiple addresses per line, separated by spaces, is OK. Multiple "hashcash_accept" lines is also OK.
By default, each user has their own, in their "~/.spamassassin" directory with mode 0700/0600. Note that once a token is 'spent' it is written to this file, and double-spending of a hashcash token makes it invalid, so this is not suitable for sharing between multiple users.
Make sure you specify this using the 'x' mode bits set, as it may also be used to create directories. However, if a file is created, the resulting file will not have any execute bits set (the umask is set to 111).