Yes, similar to the gmail + address. If Kopi became popular enough that people found it worth doing this - I think it would be relatively easy to come up with

Yes, similar to the gmail + address. If Kopi became popular enough that people found it worth doing this - I think it would be relatively easy to come up with many different approaches to prevent / mitigate this sort of thing. Different separators, passcode separators/prefixes, machine-learning based on the from / to pairings, ... all the way up to white-listing (blech). As a paid service whose continued existence depends on the customer's satisfaction - it'd be easy to justify doing any or all of those things.