alt Hacker News> (things like booking+youremail@...)
This is so trivially easy to bypass. If you're a service selling email addresses, just strip off the booking+ part and you have the "real" email address.
All my sign-up email addresses are via a catch-all email, so I can just give a service "[email protected]", or "[email protected]", so I there is no single "real" email address, and I get to track who exactly is selling my email address. So far I haven't had problems with anyone spamming "[email protected]".
They can bypass it, and as the user you can also use any other sign or character that you want. If you email is foo@ then you can use the letter x, as registrationxfoo@. A popular choice for a company email is first.lastname@, so you can use a . for it, or the - character. + is just what some program, like procmail and Sieve, will recognize without much trouble.
Using a a catch-all email with your own domain works also perfectly fine. Doesn't work as well if there is multiple email users of that domain.