It’s user+ia@gmail.com, and it’s a poor substitute for a dedicated domain. For one, every attacker knows about plus addressing and that those addresses are really all the same email account.

They still don't know what you put after the "+" to log into another service.