However, if that is not applicable, a lot of sites never verify an email address (poor security). Thankfully, many do verify.
Google never duplicate email addresses; even those including/excluding a "dot" combination. So that address is actually yours, which someone has given out, either in error (careless) or deliberately.
This is similar to receiving wrongly addressed snail mail; dialling wrong number, knocking on the wrong door, etc.
Nothing much you can do, except inform the mail sender (if you wish, no compulsion), and mark as Spam. Just be careful, if they are actual Spam, do NOT reply or unsubscribe - the spammers then know that they have a "live" one and you are on the hook. And they will on-sell your address, result - more and more spam.
You can also filter these to be deleted on receipt; you can block senders as well.
These people would not have access to your account unless they have hacked you; make sure that your account is secure. They would not be receiving your email.
Friendly reminder. Account security and password protection is your responsibility; Google can't do this for you. Google provide secure systems at their end; you must do the same at your end!
Read and use the following :-