The number of people who just didn't understand the implications of not using their own email for banks, etc is too many.

The fault is partially on the banks too IMO. Why don't they verify the emails first before sending sensitive information.

Send a fucking confirmation email to set up a financial account, Jesus. There should really be a law.