Yeah, ours was to an email account I'd registered for my son but wasn't checking regularly. Once we found out someone else had used it for Spotify I found loads of marketing spam from them in the inbox. I think it is fixed for new accounts but they obviously haven't bothered to go back and verify everyone who registered before that change.