It's not true and it's not a 'vulnerability'. When you sign up for a gmail address, all dot variations of the email address belong to you. So if you have andzd

It's not true and it's not a 'vulnerability'. When you sign up for a gmail address, all dot variations of the email address belong to you. So if you have andzdroid@gmail.com, then emails to andz.droid@gmail.com will also go to you, and a.n.d.z.d.r.o.i.d@gmail.com will also go to you. What happened to the OP is that somebody signed up using a variation of his email. Obviously, if I signed up at paypal with YOUR email address, you'd start receiving MY paypal emails. There is no vulnerability. Only stupid people signing up with other peoples' emails.