Correct. It could be someone trying to break in, or it could just be someone who mistyped his own username.
I once received a receipt for lunch from a chain restaurant hundreds of miles away. Some clown had created an account using my Gmail address. So I installed the restaurant’s app and requested a password reset. And, of course, the verification code came to my email account.
I was tempted for a minute to use the app, which was still linked to his credit card, to buy lunch 
, but I didn’t.