Out of interest, I went and put through my domains into a leaked database just to see what would come out. I found usernames+passwords for 9 different coinbase accounts... 3 GoDaddy accounts & 2 1and1/ionos accounts - Short afternoon of stealing crypto, followed by a little bit of domain hijacking.Always thought reading emails on expired domains would be unethical. This Shane Cultra guy ("Started advising dozens of companies in the domain space, defi, and crypto using my experience to help solve problems in emerging companies", LOL) brags about using it to hijack dormant social media accounts.. Nice. But why stop that short? Those same inboxes might often contain far more sensitive material like crypto exchanges or other financial logins (or even records to access enterprise systems). By his reasoning, all of that is just free game for whoever can configure a "catch-all"?
If hijacking dormant social accounts is fair play, then so are financial accounts? I see this opportunism turning into outright fraud pretty fast - thanks teacher.
"I don't think it is illegal - I own the email address to which the account is registered - what is illegal about that?"Nothing new. I first saw this suggested by @boxfish seven years ago when Acorn had threads that were worth reading:
https://www.acorndomains.co.uk/threads/twitter-account.155275/post-593101
He's out of prison now...

I found usernames+passwords for 9 different coinbase accounts...
but it is hardly worth it.
That would depend on how much is in the accounts.