How do you know where the local part starts? Google uses '+' but nothing stops you from using '-' as a delimiter if you're running your own servers.

Also, how do you deal with spam filters that are designed to spam anything without a local part? Or is this only done to "well-known" domains like gmail.com?