It is only client-side verification. I used tamper data and a url-encoder, and I was able to get a + sign in my email (and the verification email was sent with no problem).

But yeah, it's annoying when companies try to make their own email parser and get it completely wrong.