[0x3f]

If you're only passing the address in private to some service, you can just use [some-string-unique-to-that-service]@yourdomain.com. Or, more classically, plus addressing to do the same. Then you just block that recipient.

That solution doesn't apply to the use case in the article.

[GCUMstlyHarmls]

Surely spammers just turn `me+leaked/[e-mail]` into `[e-mail]` as well as `[e-mail]`, `[e-mail]` etc. The cost of stripping any `+postfix` must be about zero even at volume.

[0x3f]

Some people block all mail to non-plus-addressed emails on that inbox, so a plus address is required to be received at all. You could say then spammers will just add a random one, but they wouldn't be getting bounces and would have to guess as much. Still, even stripping the +'ed part is beyond what most of them even bother to do. That dropoff plus normal spam filters works well enough.