While that’s possible, I don’t think that’s what’s happening here. This looks exactly like the behavior of an email burying attack (https://news.ycombinator.com

While that’s possible, I don’t think that’s what’s happening here. This looks exactly like the behavior of an email burying attack (https://news.ycombinator.com/item?id=34868298 https://news.ycombinator.com/item?id=34868298). Notice that the email addresses appear legitimate. Vulnerability scanners don’t use email addresses like those. One of those emails shows up in HIBP, indicating that it probably belongs to a real person.