Someone entered a fake email address when registering for a website. The email address they used is at a domain I own, so now I'm getting "spam" from the company sending the person emails at my domain. What's the legality of using account recovery to get into the account and delete it/change it?