Whenever a new owner is added to your property, Search Console notifies all existing verified owners of the change. If you don't recognize the new owner, email that person--maybe it's an alternate email address of someone you know.
If the person doesn't answer, or if you're the only property owner and didn't add anyone else, it's possible that your site has been hacked, and someone is verifying ownership of your Search Console property in order to gain something.
If you think this user is unauthorized:
- Remove the user in Search Console.
- If the unwanted user somehow managed to verify ownership using a token (that is, they are a verified owner), you'll need to remove all their ownership tokens for your site:
- Open Search Console.
- Click the Search Console property name.
If the person isn’t listed under Verified owners, double check that you selected the right property; subfolders on a site can have their own distinct website properties.
- If the person is listed under Verified owners, then click Verification details next to the user name to see which verification tokens they used. If the person isn’t on the active list, check the unused tokens list.
- Delete all verification tokens for the unwanted user (for example, an html file on your site). You can learn more about the various methods here.
- If you have been hacked, this is only a temporary solution. Even if you remove the token, a hacker can probably add it back, so you'll have to take the next step to secure and fix your site. Either check out Help, I think I've been hacked on web.dev, and try to fix the problem yourself, or contact a website security professional to help repair your site.