It’s almost as trivial with this format too, at least to guess what address is used for other services, though it has a strong advantage over using ‘+’ in GMail in that nothing will try this automatically. It’s hard to believe anyone would intentionally try to guess a different service’s email to spam to it, but even so in my setup I prefer to eliminate this possibility completely by adding a random number to the service name: [email protected], and so on, with no catchall for invalid addresses.

So far the most spam I’ve gotten has been to the address I used for Amazon (probably leaked by a third‐party seller there).