> They want to spam you later (or sell your address to spammers) and have you not know where they got the address.

Email +suffixes are easy enough to strip off post-collection if you're aware of them. If they wanted to spam, they wouldn't have to disallow +'s in the validation regex. They must have some other reason for disallowing them, which may be as innocent as poor awareness of them.

Personally, I used Fastmail with my own domain and have abandoned using +suffixes because they're too unreliable. Fastmail has several options for single-use email addresses that should be difficult or impossible for recipients to decode to the main address.

More likely, they just googled "e-mail vaildation regex" and copied the first/smallest result from StackOverflow. Happens all the time.

not sure that's this. if you just grabbed the first one, you wouldn't necessarily know that it explicitly doesn't work with the "+". Explicitly calling out the "+" issues indicates the person likely knows what they're doing.

Uh, you're right. My eyes missed the fact that this calls out the "+" character explicitly.