I have a version of this; I have the email {{popular-asian-surname}}@gmail.com and I've seen _everything_. I've had many many bank statements from India. I've had someone in California order a brand new BMW and got the details for collection. I've had paypal invoices and statements (this is one funny because they refuse to action the delink). I used to reach out and tell them I didn't sign up for their service. But h…
One bigger item was that people were sending details regarding an estate & inheritance. This included an attorney office in Finland (to be clear, I'm also originally from Finland). After finding out I sent email to their DPO as this likely qualifies as GDPR security incident as the emails contained things like names, SSNs, addresses & of course details regarding how inheritance was split. I never got an answer so I reported it to Finnish DPA. I got reply from them pretty quickly that they contacted the DPO and that DPO will be in contact with me soon & the case is closed from DPA side. This was 4 months ago, I'm yet to be contacted by them.