Regarding security at PayPal, I've got a PayPal donation not long ago to my email address in the form of {@example.com. This email was not attached to my PayPal

Regarding security at PayPal, I've got a PayPal donation not long ago to my email address in the form of {@example.com. This email was not attached to my PayPal account, so I tried to add it to claim the payment, but client-side validation would reject it because of the funky { alias. I've disabled the client-side check using the browser's developer tools and my email was accepted by the server upon submission, so I could finally claim my 5 euros :P. All of this was preceded by me contacting support about adding my email address. They couldn't help me and told me to contact the sender, which would have been impossible, since it was a donation, and the only thing I had was a PayPal notification about a pending payment to that email address. Of course the server should have accepted the email anyway, because it was valid, the issue just highlights a faulty development process at PayPal that allows server-side validation to be more permissive than client-side validation.