The period is optional. Not using it or placing a period somewhere else and it still works. Also a +whatever before the @ works too. Easy to see who sold your data. Firstnamelastname+facebook@proton.me and every spam you get with the +facebook in the address is from data Facebook sold.

Edit: yeah, whatever happens, it is always my fault. Remember that.