Unless you default deny (send to SPAM) any email received without the +suffix field. You can then provide each entity (service or friend) a different, randomly generated, +suffix "token". You can even set filter rules so that the token must match the from field or at least the domain therein (forge-able as it is...).

Admittedly maintaining this system by hand would be a pain. But if you use a dedicated email for service log-ins and a browser extension to generate the tokens (and unique passwords), then it could be quite workable.