Think about how easy it would be to ruin someones reputation by signing them up for all kinds of shady services and then waiting for the (inevitable) breach.
Of course that possibility will not stop the witchhunt but I'm fairly sure that at least a small percentage of the people in that database have no idea they're even in it.
I've been signed up to so much over the years that I mostly ignore it now, just unsub from the things I can and mark as spam everything else.
BTW, if anyone implements a "Thank you for signing up" email, please please please put the original IP address used to sign up in the email along with the "If this is not you". The few services that have done this have enabled me to identify (from my own web server logs) the users of the forum(s) that have been peeved at me on those days. That at least gives me the chance to talk to them and stem the flow of porn emails (or whatever they've decided to sign me up to).
> BTW, if anyone implements a "Thank you for signing up" email, please please please put the original IP address used to sign up in the email along with the "If this is not you".
+1; doing a macro-level lookup of the IP address's location would be useful, too, for less tech-savvy consumers.
Not really an issue. If that's your real email they're using, you still need to verify it (many services request that as a way to confirm the account creation).
That Ashley Madison data is full of unconfirmed addresses. I think Troy Hunt's tool excludes them.
Well, except the large number of people who have signed up for services such as credit protection, Sprint, AT&T, etc. all without my email address being verified first, means this is not fool proof.
Of course that possibility will not stop the witchhunt but I'm fairly sure that at least a small percentage of the people in that database have no idea they're even in it.