Bad actors can just strip the plus part of the address