Sure, but from a security/authentication standpoint that won't be an issue. Even if you have my John+ajf@example.com address it still won't help you with login

Sure, but from a security/authentication standpoint that won't be an issue. Even if you have my John+ajf@example.com address it still won't help you with login in on other sites as the address used on another site is still unknown.