I use this pattern but I'm starting to move away from it. Some things just don't work (ex. linking accounts between companies) and it also throws customer service agents into a panic when they see their own company name in the e-mail address.

I'm also not sure it gets me that much. I do get to see how was compromised or sold my data, but most of that just goes to spam anyway. I also usually find out about the compromises from other sources anyway.

Sure some of the CSA's panic a bit, but I've never had one not go along especially after explaining my purpose. I've not seen too many compromises, but some of them were not public. Especially with small businesses like a car dealership, they may never know themselves.

Try just rot13 or hashing the website name.