Some of our users have received email from google: "someone added you as their recovery email".
Does anybody have any clue about what kind of attack vector this might be or lead to? These emails are from google, the normal process of adding recovery email.
This is not the kind of mistyping an email address as in john.do@ vs john.doe@.