Abstract: Email addresses serve as a universal identifier for online account management, however, their aliasing mechanisms introduce significant identity confusion between email providers and external platforms. This article presents the first systematic analysis of the inconsistencies arising from email aliasing, where providers view alias addresses (e.g., ALICE@example.com, alice+work@example.com) as additional entrances of the base email (alice@example.com), while platforms often treat them as distinct identities. Through empirical evaluations of the alias mechanisms of 28 email providers and 18 online platforms, we reveal critical gaps: 1) Only Gmail fully documents its aliasing rules, while 11 providers silently support undocumented alias behaviors; 2) Due to lack of standardization documentation and de facto implementation, platforms either fail to distinguish alias addresses or overly aggressively exclude all emails containing specific symbols. Real-world abuse cases demonstrate attackers exploiting aliases to create up to 139 accounts from a single base email in npm for spam campaigns. Our user study further highlights security risks, showing 31.65% of participants with alias knowledge mistake phishing emails as legitimate email alias due to inconsistent provider implementations. Users who believe they understand email aliasing, especially those highly educated, male, and technical participants, are more susceptible to being phished. Our findings underscore the urgent need for standardization and transparency in email aliasing. This article contributes the OriginMail tool to help platforms resolve alias confusion and disclose vulnerabilities to affected stakeholders.