Users are allowed to enter a plus sign in their email when updating email address in the profile section. Users can validate this email address as the validation email will be correctly sent and clicking the link works. The success message popup displays the email address but without the plus sign anymore, but this could just be a display thing I am not sure. When the user tries to log in with the new email address, they will not be able to.
Seems like the email address is probably being modified upon persisting to the database or whatever backend this uses. Possibly stripping the plus sign out, but I have no way to tell.
Example: taco@gmail.com changing their email to taco+stackoverflow@gmail.com
Both are valid email addresses however the latter is impossible to log in with even after confirming the validation email.
foo+bar@gmail.com == foo@gmail.com
. Did you use Gmail just as an example?foo+bar@gmail.com
equalsfoo@gmail.com
then it is allowed as part of a gmail address. It is allowed as an alternative form. In any case, whether it is an alias or not shouldn't prevent someone using it as their account address on here, I would have thought.