[d110af5ccf]

> tempted to log in and shut these down, but I'm pretty sure that is illegal

Ehh. Intent matters a lot. I'm not saying someone couldn't go after you, but as long as you weren't actively trying to make off with their data or impersonate them I think you'd be in the clear.

Imagine you got such an email and were confused. So you went to log in but couldn't. So you reset the password in confusion. That's not illegal, it's a very reasonable response to being notified of an account that you don't remember creating. If contacting the service provider fails, closing the account would seem to be the only remaining reasonable course of action. It's not your fault the service provider doesn't verify things.