I used to get alert emails, from google, for what appeared to be someone with my email address in another tld. I probably could have reset their password and accessed everything. Maybe they can access my email.

I sought support but never got anything official and commenters brushed it off. But I'm pretty sure it was similar to your issue.