Almost all websites allow it. The ones that don't are generally fairly restrictive and probably just check is_alnum(). I use it all the time to segregate incoming mail. I have 1Password and generate a random long password for each account, so I'm not particularly concerned if one or multiple accounts are breached. This means I have to trust 1Password of course, but I'll risk it.

The problem for me is inconsistent support. For example, when validation allows it, but the server-side strips the +. I recently booked a flight with Monarch (UK super budget), email address:

[email protected]

This got stripped to [email protected] which I'm sure doesn't exist for my name. I couldn't change the email because.. surprise.. you need a confirmation email to do it. Fortunately you only need the booking reference and the address to check in, but it was a bit annoying.