I have a wordpress website and it is connected to google search console. Very often atleast once a month i experience this issue.
Anonymous sitemaps containing fake links (just to drive traffic to attackers properties) are added to my domain.
Whenever i happen to check manually only i am able to detect and remove it.
On the wordpress site I have some basic security plugins setup and write protection enabled they are not helping for this issue.
If anyone can help how to stop the attacker from adding sitemaps without authentication will be a great help.
P.S: I got a google notification for accessing my property by an anonymous email once in the past, but when checked for any such users there was no one i could see in search console settings. But I had this problem even before getting this notification.
Please refer the screenshot of all the sitemap that are added by attacker.