I have a fairly common surname and get a bunch of stuff meant for other people. My suspicion is that their legitimate username is just one or two extra characters after mine, e.g. "[email protected]" vs "[email protected]". People probably think that, as long as they are careful about communicating the right username, it will be fine; but communication requires skills on both sides, and it's easy to miss a single letter or digit in common conversation or in poor lighting.