If it's a privately used domain, then tools could be modified or built to monitor that (if this approach becomes popular or if an individual becomes targeted, possibly other reasons).

Approaches for randomly generated usernames are probably the best way to go. DDG's @duck.com email service (and similar) is pretty fantastic if you're forced to use an email.

Bad: sebastianmiller+product1@email.host sebastianmiller+product2@email.host

Good?: product1@sebastianmiller.ismyrealname product2@sebastianmiller.ismyrealname