I don't agree with "It's gmail fault" and also I don't think Netflix should validate the e-mails. Why?

Most of the startups I work for don't require a valid e-mail when you enter your payment information. Reasons are multiple - conversion drop, "we took your money, we don't care", the e-mail is anyway entered with the payment provider, etc.

Also what comes to your e-mail and you act on is your responsibility. I don't know about you, but I don't pay for more than a dozen services with my card and I usually am aware when / what is being paid, so a scam like this would be easy to detect.