Instagram is another site with this problem. Someone supplied my email address when creating an account in late 2018. I only know this because I started receiving emails to confirm my email address. Then I started to get a bunch of emails telling me about new posts from other users. Gmail account history only showed logins from my browser and IP address, so I don't believe my account was compromised.
I finally got tired of the emails, so I told the site I forgot the password, changed the password to something long and random, then deleted all the content. I remember having to do something unusual to delete the content, like spoof my useragent to pretend to be a mobile device, or something like that. I've never used Instagram before or since, but it really annoyed me that I have a problem due to their lax controls.
Instagram never should have activated the account and allowed any activity until the email address was verified, which I never did. If a big site like Instagram can't get this right, it doesn't surprise me that a small site like Goodreads can't either.
replies(3):