"This makes me wonder if anyone has set up canary emails or phone numbers in their phone contacts."

We (rsync.net) have a handful of dummy/fake users in our database whose emails we monitor. The email addresses are cryptic and random and use a different domain, etc.

We should never see an email sent to one of these "canary" email addresses and, so far, we have not.

I am also aware that many of our customers sign up with service-specific email addresses, using the '+' character ... something like john+rsync@mydomain.com.

I personally have a rich and well developed pseudonym that I use for all online non-governmental transactions but in some rare cases I need to use my actual name and email - and in those cases I create '+' aliases.