I do the same thing, but instead of plus addressing I give each vendor a unique email at my domain. I now receive spam on my mint, geico, tumblr, lendingclub, disney, adobe, and dropbox addresses. In my case it's always outright spam instead of something remotely legitimate.
Your situation seems different than mine. I think my addresses were taken during a security breach instead of being sold by the company.
In my case I just change my address with the company to dropbox2@, and block the original address.
I also have a friends-and-family email address that isn't published anywhere online that finally started receiving spams. I think it was taken from a neighbor's address book in hotmail when he got phished.
I think a possible long-term solution would be for everyone to have a unique address for everyone else. The email software would auto-negotiate a unique address after your first communication with the person, creating a pairing similar to a friendship on a social network. I'm getting off-topic, but here's a link explaining what I mean a bit more: http://stevenjewel.com/2014/02/clearskies-chat/ (It's about decentralized IM instead of email, but the same antispam technique would work for either.)
