On: Gitlab password reset bug leaves more than 5.3K servers up for grabs

[kazinator]

If they hijacked the domain, so that they control the MX record for it, they could just use that very address.

[kazinator → kazinator]

This could happen when the owner of a domain loses or drops it, and a bad actor picks it up.

All they have to do is set up a SMTP server and wait for junk mails, thereby learning about the e-mail addresses. Say Walmart sends some flyer. Poof, they have that user's e-mail, and the fact they are registered with Walmart.