This is quite timely. I’ve been getting these a lot recently and was just looking this morning if there was anything I should be concerned about beyond normal spam or ways to stop it.
Hopefully Google can find a way to address these, as I would still like to get legitimate bounce back notifications.
I've been getting them too! It's also surprising to me that this is possible to do at the technical level, I would have thought that DMARC or something would prevent it.