I've been receiving jcpenney spam for years because while their account system allows you to sign up with a "+" their unsubscribe system doesn't.

They _do_ know better (i.e. they know you use it for filtering) and that's why they don't accept it.

I don't like it either, but it's a reasonable choice for them to make.

I completely disagree! This is not a reasonable choice. Email forms must confirm to the RFC standards or else there is no standard. The biggest offender I've run into is Yahoo. Yahoo's email address filtering won't allow me to use my email address because they reject my TLD. Even lousier, their technical support form also rejects my email address, so I can't even send them email to have them correct the problem.

I presume you mean the SMTP RFC standards. If so, then it would be unreasonable to respond with 501 (Syntax error in parameters or arguments), just because they don't like your email address format or TLD.

However, if I'm offering a service and collecting email addresses as part of that service, my mail form could do additional validation (e.g. I might not want to collect email addresses from the UK (.co.uk) or from .edu or from people with 'john' in their email address.

I'm not violating an RFC with my email form, which may provide some benefit (e.g. stop fake email addresses, reject customers I don't care about) at the expense of losing/angering some other customers. That's a business question, not a standards issue.

(BTW - I've never restricted email addresses on a form in this way, but can empathise with those who do)

I honestly don't think they do know. It's more likely that some frontend dev just copy/pasted some email validation regex they found somewhere and called it a day.

Same here, but its better than what I hit the other day - the ptrchase form accepted my +'d email, but the sign in form wouldn't. I had to get their staff to change my email in their database just to get the thing I bought...

You can rearrange the dots in your username to create variations. err.or54 e.rror54 er.ro.r.54 then you can filter the variation to a less frequently checked folder.

I had previously dismissed this method for spam-prevention because how many dot permutations can you possibly create, and how would you remember which permutation corresponds to each company (so you know which one to block when you start receiving spam). With just 11 letters in your username though, you could generate upwards of a 1000 unique email addresses! No need to remember them in a database, because you can just block the address that's getting spammed.