> The next thing

Mildly related: At one point I was considering how easily someone could make an e-mail server where valid addresses were all in the form username+code@host, where users could create/manage valid codes using a smartphone app, noting which ones were for which purpose and having inactivity or expiry rules.

Unlike current user+anything@host forms, a the + component would be mandatory, and an incorrect/expired code means spam filtering.