This is one of many good reasons to set up your own mail server. You can configure a "catchall" email address, then make up username components at will, no "+" required. I make up a new email address for each organization that requires one. This not only makes it easy to see who is selling your address, it makes it simple to refuse mail to compromised addresses at the early-stage SMTP level, or to trap machines attempting to send to those addresses in a honeypot.
What has surprised me the most after doing this for many years is how little address selling seems to be going on.
I've been doing this for 7 years with great results and love the zero configuration needed for registering at any site with a unique email address.
In the past few months, however, I've been getting spam that simply brute-forces usernames across my entire domain, leading to hundreds and thousands of spam emails per day. Gmail catches all of it but this makes looking for the occasional false positive very difficult. I've lost a number of emails that ended up in my spam folder between pages and pages of real spam.
So you're using Gmail in conjunction with your own domain? I find that the vast majority of spam comes from dynamic IPs and known spammers. Using the spamhaus blacklist catches almost all of it.
What has surprised me the most after doing this for many years is how little address selling seems to be going on.