It’s not a security issue. It’s a user confusion and poor validation issue.

I was an early GMail user and have a common-ish name. I probably get 30-50 emails a month from confused people ranging from contracts to receipts to racy photos.