Not by a random private company. The parent comment seems to talk about cases where somebody signed up with somebody else's email address. There are plenty of t

Not by a random private company. The parent comment seems to talk about cases where somebody signed up with somebody else's email address. There are plenty of that kind of stories around, and a few have made front page here. A company that does not validate that the email address actually belongs to the person/entity they have consent from does not have any reason to store and process that email address. The same goes for other PII. If I sign up with your data, you've never consented, and whatever terms I accepted with a click or two have no relevance to you. Companies just usually don't bother with validation unless they need it for billing purposes, because it's a hassle and might make the customer reconsider.