Noticed a legit "Welcome to Walmart" to my email (Gmail) out of nowhere. I had not signed up for it. Used my email to log on to walmart.com using "Forget my password" for it to send a verification code to, and the account was real.
It had my actual Gmail as verified, but a phone number that was NOT my own was also verified. Other Walmart profile details included an address and credit cards NOT mine. A purchase was in progress and I immediately stopped it. Changed the phone number/email/password of the Walmart account, enabled two-factor auth, deleted the credit cards. The charge and more credit card adds (again, not my own) were attempted again while I was in the midst of all this. I will fully delete the account later, but for now, it looks like I stopped it.
Walmart customer support contends my Gmail was compromised, as they would've sent a verification code to it in order for it to be. I never noticed such an email, nor was it in my Spam folders. They couldn't tell me when the account was opened, other than that it was "0 months" ago, so new.
I crawled through my Gmail settings. Changed password (I've had the same one for about 5 years now). Set up a passkey that uses my fingerprint. Did not see any unauthorized accesses in, nor any weird devices where there were active Gmail sessions. Ensured no weird forwarding, POP, IMAP settings, verified phone numbers. The only thing that may have been weird was an email address I didn't recognize that was marked as "blocked" and would forward those addresses into spam. I removed this.
My credit cards are fine with no unauthorized transactions (again, the cards I saw on the profile didn't match mine).
I have the bogus address and phone number of the Walmart profile before I changed everything. The address looks real, and is on the other side of the country from me, and was where the purchase in progress was being shipped to.
I'm still not fully convinced my Gmail had been compromised, but I suppose it's possible and I had missed it somehow. I'm pretty tech savvy and protective of my info but am confused here. Any other ideas on what could've gone wrong or things for me to check? Also if there are any other good subreddits I can post to solicit opinions? Thanks.
Edit: People seem to be missing that regardless if someone just had my email address, how would the email in the account have gotten "verified" via a verification code that one would have to enter in if they didn't have access to the email in the first place?
Edit2: The "Welcome to Walmart" email was never clicked on for its internal links. So, no, that was not a verification itself. I manually entered the "walmart.com" URL, entered my email manually, then did the "Forget my password" feature for it to send me a verification code, proving the account existed and had been completed.
Edit3: Another thing that leans me that this was some scammer was when I was frantically deleting their purchases and credit cards they kept adding, the "payment info" of the credit card