I control spam by using email aliases. And it makes it easy to track exactly who leaked/sold my email address. But I don't use gmail, as I value my privacy.
I whitelist using regular expressions (specific prefixes mostly). Gibberish and random localparts are unlikely to match those, it effectively never happens.
Agreed, there are also ways to employ aliases which won't prevent spam, but this still doesn't explain the relation to the subaddressing regex or why other ways or employing aliases (e.g. masking) are never enough.
In my experience, most passengers unfamiliar with the Tesla Model 3 instinctively use the emergency door release in non-emergency situations, rather than pressing the button as intended.
I'm currently experimenting with this. It's been hard for me to find a pattern that the ai can't read without making it hard to visually read the plate.