This is one of many good reasons to set up your own mail server. You can configure a "catchall" email address, then make up username components at will, no "+" required. I make up a new email address for each organization that requires one. This not only makes it easy to see who is selling your address, it makes it simple to refuse mail to compromised addresses at the early-stage SMTP level, or to trap machines attempting to send to those addresses in a honeypot.

What has surprised me the most after doing this for many years is how little address selling seems to be going on.