Heh, same. The excuses I get from companies are hilarious. In my case they're just the domain, but encoded and obfuscated. The company will claim anything to get out of it, that my account was compromised, all the way to someone guessing it.

Irritatingly, when I signed up for the utilities at my apartment I used a single address "utilities@domain.com" for simplicity. One of my three suppliers leaked my details with that address, and they all deny it. Took less than a week from moving in to getting penis pump advertisements at that address.