They're just regex rules, and unfortunately, they strip them out for exactly the reasons you might guess.

As another commenter mentioned, company@domain.com is difficult for them to get around.

I will add that this tactic has caused additional friction or touches for things it shouldn't have¹, but has finally delivered the desired effect.

¹e.g. insurance offices calling to confirm my email address, customer service people curiously wondering aloud if I work for their company