In the last 7 days I've received emails from <removed> directed to two email addresses that don't exist on a domain I own.
I forwarded these emails to spoof@paypal.com and the response from PayPal indicates that the emails are genuine and that someone is managing to create fraudulent PayPal accounts using my domain without any verification, they also appear to be posting listings to eBay using the same email address, again without verification.
I also looked at the email headers and I see DKIM PASS which also indicates the emails from <removed> are genuine.
None of the emails I received appear to be requesting email verification, which means someone is able to create accounts without verification.
What can I do about it?
