Yeah, I bought my own domain specifically so I could set up a catch-all email service. Everything sent to my domain hits the same inbox, but I can easily see who has sold my info. If I start getting spam addressed to “walmart@example.com” then I know Walmart sold my info. And I can easily set a rule to automatically mark anything addressed to that burned account as spam.

Lots of websites quickly caught onto the “just add a + after your regular email” trick, and set up an internal rule to remove any of the + tags. So that old trick is largely useless.