Say our domain is contoso.com. We have our email set up so if anybody typos an email address it lands at firstname.lastname@example.org. So if you email anybody in the firm but get the email address wrong it will land in the support email box.
We have received emails from Paypal in the support mailbox indicating someone tried to open an account using, say, 'email@example.com' which does not exist. We are sure this is not anybody in the firm. Only I have the ability email accounts and I am sure my account has not been compromised.
Question is, why would anybody do this? What's the point of trying to open a Paypal account as firstname.lastname@example.org if you have no way to receive those emails?