So this is true on the email provider side, sometimes. Gmail (and a lot of others) rout foo+bar@gmail to foo@gmail. It's not required, but it's common.

The problem here, though, is that the email sender just stripped the + and sent the content to [email protected]. That's just a totally different account, chosen without warning.