Hi Bill
mydomain is my surname, a very common surname, on a gtld, that I got (by chance) more than 2 decades ago when there were only 5 accessible gtlds (com net org info biz). So yes it is theoretically quite possible that the whole thing was/is accidental...
... however I doubt this very much, as I think on the contrary it is quite deliberate, because
- this is no one-off mistake, they have been using <whatever>@mydomain.tld as recovery emails for almost 2 years now, for over 30 or so Google accounts, so they must by now be aware that they have lost control of a few of those, and thus make correction to their script (if they use one) to correct the mistake. I just received the latest recovery email notification from Google no later than earlier this week.
- the handles xyz67890 are never the same, each is always unique / used only once, very long, combining characters and digits, very spammy-looking.
- quite a few of these Google accounts are newly created, with recovery email set (presumably for the 1st time) directly as
xyz67890@mydomain.tld, so disproving the theory of someone taking over an existing account and resetting recovery email. I know these are newly created, because I could see the Welcome to Google email in their Inbox with the date & as well as the browing history.
These people know that mydomain.tld has a catch-all (very easy to guess if they look up my DNS MX records), and I strongly believe they set their recovery emails (but never with the same handle twice) as @mydomain.tld deliberately, not accidentally. But for what purpose..?