Mark,

All the ones I checked had registered on the website. The email
addresses are mainly gmail and yahoo. The addresses all appear to be
valid.

I guessed wrong about email versus website, which means the addresses aren't necessarily compromised accounts.

That the addresses are valid is consistent with an experiment I tried. Entering an invalid address (from a valid domain) on the website resulted in a blue "B" (Bouncing) status rather than "NC". Entering an invalid domain (example.com) gave an error to the user and didn't create a pending member at all.

Shal
https://groups.io/g/Group_Help
https://groups.io/g/GroupManagersForum