Its worth pointing out that other people can use your email address to create accounts. It's just a string of characters to type in.
They might not even know it's yours, like if your email is davidsmith@gmail and they fat-finger davidrsmith@gmail--boom, "you" now have an account.
Good services use double-opt-in to ensure that every account is actually tied to a correct and working email address. But not every service does this.
And even services that do use double opt-in would create a row in their database to note that a confirm email was sent out. If they never scrub those invite rows, "your" email address would still be in the DB when it's exfiltrated, even if the confirmation process was never completed.
They might not even know it's yours, like if your email is davidsmith@gmail and they fat-finger davidrsmith@gmail--boom, "you" now have an account.
Good services use double-opt-in to ensure that every account is actually tied to a correct and working email address. But not every service does this.
And even services that do use double opt-in would create a row in their database to note that a confirm email was sent out. If they never scrub those invite rows, "your" email address would still be in the DB when it's exfiltrated, even if the confirmation process was never completed.