I just checked my own domain and there are three addresses pwned that I don't use and never created. I've had the domain for years too.

Probably someone just making up an address randomly but three times is a bit odd.