Every once in a while, I see an email like this:
Someone (hopefully you) has used this email to register at My Website Username: ********* Password: ********* Thanks My Website
I login to my site, and sure enough, my admin email has changed to the one mentioned in the email. I freaked out the first time I saw it. I thought someone was trying to take over my site or put spam or ads on it or something.
However, since then, I've been using "WP Persistent Login", which tells me which devices are logged into my site, and every time my admin email has changed, I don't see any devices logged into my account, except my own.
These might be registered users on my site, but I'm not entirely sure. I have around 1200 legit registered users and around 800 that I think are spam accounts. I'm not really sure how to get rid of them and not sure if the changed admin email is from one of those that already existed or if they popped up just to change my admin email.
Could this be happening by accident? What precautions should I take?
I forgot to mention, these emails are not going to my account, they are being sent from my G Suite account, which is what my website sends from.