OK ... so ...
I used to belong to organisation X. For that membership I create a bespoke, and I think fairly unguessable email address.
I have now received an email:
From: Google <noreply@google.com>
To: (unguessable)
Subject: Verify your email address
What are the plausible scenarios? Here's one:
* Organisation X has lost control of my email address;
* The email address has been obtained by bad actors;
* Bad actors assume it's a general email address and try to log in to Google with it.
Can you think of others?
@ColinTheMathmo have you tried https://haveibeenpwned.com/ to find out whether that email address is in any data breaches?