I recently logged into one of my email addresses that I hadn't used in years and discovered quite a few people had used it as their address for multiple things

I recently logged into one of my email addresses that I hadn't used in years and discovered quite a few people had used it as their address for multiple things (of course they didn't have access to it so everything was unread). Lots of services do not really bother to validate the email address (there were e.g. Facebook, Instagram & TikTok emails). One bigger item was that people were sending details regarding an estate & inheritance. This included an attorney office in Finland (to be clear, I'm also originally from Finland). After finding out I sent email to their DPO as this likely qualifies as GDPR security incident as the emails contained things like names, SSNs, addresses & of course details regarding how inheritance was split. I never got an answer so I reported it to Finnish DPA. I got reply from them pretty quickly that they contacted the DPO and that DPO will be in contact with me soon & the case is closed from DPA side. This was 4 months ago, I'm yet to be contacted by them.