It won't stop spam but the biggest risk with these leaks is from automated testing of a password found from a leak on one service you use with the same email address on another. As long as you use a separate + address for both you'll be safe as they are unlikely to automate testing of different + addresses since most users don't do that.
> A better way is to set up a catch all on a domain... but then you're likely to get a lot more spam
I forward my catch all domain emails to gmail. I hardly get any spam now except to leaked addresses which I've filtered to add bright red labels so I can ignore them.
If I were attempting to exploit the Adobe list, every email address I saw like [email protected], I'd try the exposed password using not just [email protected] and [email protected], but also [email protected], where "othertarget" might be something like twitter, facebook, paypal - depending on where I'm attempting to misuse the exposed credential.
>4) Always create a separate email (or an alias) while signing up for cloud services, so you can eliminate guess work during a crisis. So, instead of signing up with [email protected] for Adobe or someone else, use [email protected] (this will redirect to [email protected]) or rather create [email protected] or something (gmail is just an example). This way, you can always trace out the right service responsible for the leakage of your details whenever something goes wrong.
Doesn't stop someone just removing the + tag on the email address.
A better way is to set up a catch all on a domain... but then you're likely to get a lot more spam... (to things like mail@, contact@ and a whole bunch of firstnamelastname@ guesses)