There are a number of risks, for both you and (assuming it was a mistake) the domain owner.
For you, it means at least exposure. In some cases, that can mean more DDOS attacks. If the domain owner had some issues with hackers, that may come to your website too.
If the domain that erroneous points to you is blacklisted somewhere, that blacklist could in some circumstances extend to your IP address (depending on who does the blacklisting).
It is possible that some DNS registrar contacts you with an invoice. You should not need to pay that, but it is again an annoyance.
That is more or less the list of risks I can think of.
For the domain owner, it effectively means that you are now in a position to do a MITM attack on him. For him, that is a serious risk. The domain owner should at least be grateful for your 404-serving approach.