Odd that you are talking about security breaches with this..

I figured sites wouldn't want to accept it because they know you are most likely filtering their emails so they have a much less chance of getting through to you.

If someone is stealing emails/passwords from a site obviously they will just strip characters after the plus to obtain your normal email address?