In my case I’m sure that accounts have genuinely been set up which use my email address. I wonder if it’s due to the way email addresses are resolved, with eg.
first.last@gmail
firstlast@gmail
firstlast+123@gmail
all being forwarded to the same box. Or maybe someone just typed it in wrong. Regardless, my email account is secure and they have not hacked it. It’s just other people sharing my name, coupled to crappy systems that don’t verify adequately.
When I recently started getting notification of every trivial credit and debit in some Ghanaian randomer’s bank account, I did eventually get the bank in question to stop sending them, by tweeting about it (email had been ignored).