I used to use this technique for many years, but occasionally ran into issues with form validators rejecting the email address. I finally stopped because I never got spam from those email addresses (even in spam folder). I figured it's trivial for spammers to strip out the extra text, any half-decent spammer should know this trick. Also, I suspected they might change the +text to put the blame on someone else.

Can't the spammer just s/'\+.*@'/'@'/ or something and throw away the + sign and all that follows? Or the company could do this if they were selling your email address.

While we're on the subject, all combinations of dots are equivalent. this.isme and th.isisme and thisis.me, etc. Finite variety, but good enough for a few generic throwaways and never filtered or stripped that I've seen.

I use [email protected] combined with a catch-all address for that sub-domain. It gets around various email validation regexes that won't accept +.