def is_email_address(email):
         return '@' in email

Seriously, the only way to validate an email is to send them an email and make them click a validation link. I

Sometimes you don't want the user to stop what they are doing, wait for an email to arrive, hope it doesn't land in spam, read it, click then link, and then continue. This is usually the case if you want them to buy something.

Secondly, what happens when they don't get the email? We had lots of problems where people where signing up from the following domains: gmail.cm, gmail.co, gmail.con, tmail.com, gmail.oom, gamil.com, hotamail.com, homtail.com, etc.

You want to firstly do some simple checks to see if it looks roughly like an email address. I like to see if it matches \S+@\S+\.\S+ (and ignore the few people with a top-level domain). Then you want to validate the actual domain to see if it's a misspelling of a popular address.

I agree that the example with a lot of symbols is over the top, but when a website doesn't accept [email protected], I assume the product will be sub-par quality wise. The author did not follow of rigorous process for something as simple as email validation, I doubt he'll be more rigorous in other parts of his project.

  http://www.zappos.com/[email protected]

  http://www.zappos.com/?email=foo%[email protected]

Hardly a valid comparison. Yes my theoretical non existant service would validate addresses like yours. That is vastly different to the one I mentioned.

Since I was in a hurry to buy the tickets (a last minute gift), I signed up for a second account without the "+SERVICE" section, bought the tickets, and sent them an email asking them to either merge the accounts, delete the old one, or otherwise allow me access the other account so I could purge my credit card data.

What happened next was a bit shocking. They sent me an email back a few days later saying that they had fixed the issue with my account by removing the '+' symbol.

The risk of exploit was relatively low due to the extreme obscurity, but it was technically possible for a short while for a person to go to my email provider and register the username "nameSERVICE" and access my account on the ticketing website, including my credit card information.

  ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org"

[edit: I see your address in your profile. It is nothing like the example given.]

I'm sorry but abiding by the RFC is the definition of a valid email address.

Postel said it best "be conservative in what you do, be liberal in what you accept from others."