[detaro]

Just receiving e-mails would hardly be a way to "monetize it by phishing".

[Cpoll]

You could probably just redirect all emails to @gmail.com, and most users would be none the wiser. Then you'd be able to trivially do password resets on any accounts that were created with the typo domain.

[gravypod]

Or just sell the emails to unsavory people.

They were sent to you, you have a right to sell them (so long as you're in a one-party-consent state when it comes to recording). You're up to snuff law-wise.

Definetly a shady thing to do.