Wow, that's a lot of bad. How did they manage to create an account with your email address? Doesn't it require verification?
Cloudflare (at least at the time) would let you create an account and start doing stuff without verifying you actually owned the email address
Fat-finger? bob[at]bob[dot]com to bon[dot]com? No worries
Enter my email instead of yours? Go for it
It's just a login...right?