This has happened to me with quite a few websites (netflix, nytimes, dropbox, and many smaller more localised websites for small businesses / services): people somehow seem to have registered and/or added payment details with an email address they don't own.