There are three possible risks involved here. But before that, did you check to see if you ever received any e-mail from WordPress on account confirmation?
The first possible risk is, someone accessed (and may still have access to) your e-mail account and you never realized. This would be a possibility if the following two are true. First the account was originally created using your e-mail. Second, you cannot find the confirmation e-mail because someone had access to your e-mail, confirmed the account, then deleted the confirmation e-mail.
Second risk is not a risk for the e-mail account owner. The scenario in this second case is, someone may have changed the e-mail listed in their WordPress account, to your e-mail address by accident. The security risk here is not for you, it is a risk for the WordPress account owner. It could cause an issue if they make the same mistake again when changing their e-mail for their bank or credit card account. Then you would start receiving e-mails regarding their bank or credit card companies. You should contact WordPress regarding the issue and tell them the account you are getting the password recovery e-mails from is not yours.
The third possible risk is again a risk for the WordPress account owner and not you. The WordPress account owner may have accidently mistyped your e-mail address instead of theirs into the backup e-mail address, in their e-mail settings. They may only be using that e-mail account for WordPress only, and have selected forwarding a copy to back-up e-mail address, thus the reason why you are receiving the e-mails. The risk here is if they start using their e-mail account for purposes other than WordPress, where you then might start receiving their e-mails.