The exploitation and potential damage would be service specific. Say a Dropbox like service for computer file syncing: An attacker creates an account for '[email protected]' and gets the signup email automatically confirmed. The attacker uploads some malware files to the account. After some time Alice attempts to create a valid account and resets password for '[email protected]'. Then Alice installs a desktop file syncing client provided by the service and malware files from the attacker get downloaded to her machine.

Another example would be if a company hosted a web app for employees that allowed signups only from @company.com addresses. In such case an attacker could be able to signup with such an address.