Agree with you, though potentially easily remediated if that third party provisioned for the “+” convention.
<my initials>-site-<companyname>@<my domain> go to my personal mailbox
<my partner's initials>-app-<appname>@<her domain> go to my partner's mailbox
<daughter initials>-account-<entity name>@<my domain> go to my daughter's account
Sure you could in theory set up the server side verification mecanism for these pattern too. I am just stating that the +suffix stuff is not the only way used.