They setup the account with his email on accident because it’s likely close to a lot of other emails.

Essentially it’s his account although legally I don’t know how that would go if say you emptied someones bank account

If someone signs up with your email, you can trigger a password reset and it sends an email - to you.