I got some weird emails today. Supposedly from OnlyFans, so my first instinct was that this was some kind of scam. But no, it really came from one of their subdomains (backed by Sendgrid), DKIM signature checked out and all. Then I thought maybe someone had hacked Sendgrid again, but all links in the email went back to the real OF domain, so that didn't make much sense either. But the even weirder part was that two minutes before the email had shown up in my main inbox, another email with the same content had shown up in my catch-all mailbox, sent to an address with the part before the @ misspelled. I really don't think anyone capable enough to hack Sendgrid would be sitting there manually misspelling email addresses. Anyway, after requesting password resets for the two accounts I supposedly had, the picture became a bit clearer, because once I got in, the UI constantly reminded me that my email address had not been verified yet. So it seems that OnlyFans allows people to either create accounts or change their email addresses without verifying them. I don't know what the point of that is, and I don't know why anyone would try to sign up with my email address, since the platform lets you do basically nothing without verifying your email... but okay.