It’s [email protected], and it’s a poor substitute for a dedicated ___domain. For one, every attacker knows about plus addressing and that those addresses are really all the same email account.

They still don't know what you put after the "+" to log into another service.