Somewhat similar: my email just happens to be ideal for people in asia (read: S.Korea) to assume when they create accounts; one of them actually somehow (nobody knows how) took over my Apple dev account.

In my case, I got a real human on the phone and we walked through reclaiming my own account; when I got in, I could see the Korean's actual name, visa card, address, etc. I erased all that, then setup 2 factor authentication.

Something like that happened on battle.net. They are not smart enough to use email validation, so imagine my surprise when my email was already used when I decided to sigh up. I managed to reset the pwd, so that fellow will never be able to play again on that account, but battle has not really been satisfactorily responsive (the account seems rigged for talking in Korean, so it's useless); I ended up using a different email.

Websites which don't use email validation are problematic.

But, Apple does pay attention. It does seem that they should pay more attention to you and your specific case.