Per:
https://github.com/discourse/discourse/commit/6f9177e2ed273ebebb8306299425cbfabbf57101
This is now complete.
Use the site setting enforce_canonical_emails (default false) to enable this protection.
Once on, we disallow duplicate registrations for people using the . hack in googlemail.com and gmail.com and the + hack globally.
Fix is very safe and has zero impact out-of-the-box when it is disabled.
A side-effect of the implementation is that 1 more duplicate account will slip through once you enable the setting, as we do not store canonical form emails in the user email table unless you turn on the setting. This is perfectly acceptable imo, cause in general I am unable to find cases of this exact abuse across quite a few sites we host.