Is it too much of a reach to assume that any half-talented identity thief or exposed-user-list-scammer might be smart enough to know about rfc5233, and would write hs scripts/bots to automatically try the obvious variations of an email address of the form [email protected]?

If I were attempting to exploit the Adobe list, every email address I saw like [email protected], I'd try the exposed password using not just [email protected] and [email protected], but also [email protected], where "othertarget" might be something like twitter, facebook, paypal - depending on where I'm attempting to misuse the exposed credential.