This is a good point. For me, the actual email problem isn't huge - my first line of defense is giving out a burner email unless I want the primary site to be

This is a good point. For me, the actual email problem isn't huge - my first line of defense is giving out a burner email unless I want the primary site to be able to contact me. So I don't expect to get truly hammered with spam, and just want a way to know what happened if someone does sell the address. The invalidation issue is a bigger one, and a subdomain is certainly a better solution for it. Disposable emails and the + notation are nice for people who either don't want to leave gmail, or are bound to it via college or company email system. They aren't the best cure, though.