Does anyone store fake unique email addresses to see if they've been compromised? I assume you'd need to seed it with new ones occasionally or on some kind of schedule.
Lots of people will create a single address for each company that wants one, so that if it gets compromised it can be shut off without affecting any other incoming emails. And identify the offending firm. I have created an email account for a store that wanted an address while I was out in their parking lot (the ones that had plausible future value to me).
So far, none have been sold to marketing lists. Which says either that I'm a pretty good judge of firms, or that no one is interested in me. ;)
If you use gmail, you can insert random periods or append `+word' to your email address and it'll be delivered to the same address as one without periods and the `+word' portion. So, an email to `my.email.address+hackernews@gmail.com' will be delivered to `myemailaddress@gmail.com'.
That certainly accepts plus signs. I'm sure there are theoretically valid addresses it wouldn't accept (IDNs spring to mind), but HTML5 is willing to be "practically", rather than theoretically, correct. Anyway, there are email validation modules in every popular language. A good technique, which seems very common, is just to make the user type their email twice. Invalidity is not the most important reason why an address could cause problems.
I would assume that internally there would be some lookup to know to deliver an email to `myemail@gmail.com' to the actual user at `my.email@gmail.com', but I could be wrong. I can't test this because my email address doesn't use periods.
At my last company,we inserted fake accounts into datasets when sharing with 3rd parties(eg: SaaS based analytics). If our data ever made it out, we had the ability to trace the leak to a vendor.
