Yeah, and not even reasonably so.

In a related case (to be released soon) someone signed up with numbered email addresses on a private domain.

It's no question where the vulnerability lies, but that's nothing we can fix ourselves. So until someone at the mothership wakes up, we'll have to be vigilante!