This is why, on my semi-personal (<10 users) email server I process several different characters as tagging characters: dot, dash, underscore, and plus IIRC.
I use a subdomain as catch-all; *@something.example.com all goes to one folder. That way it's impossible for the spammers to know that this is a "sorted" e-mail address since lots of people have e-mail addresses under a subdomain and it's not trivial to filter out like myrealidentity+youareaspammer@example.com turning into myrealidentity@example.com.
Other users on my setup can use it, they just have to pick a different "something" if they want to use the same example.com as me.
