> It turns out that GitHub doesn't require proof of ownership in order to set a custom domain.

This is a major blunder. GitHub management needs to close this loophole immediately and delete this idiot's account.