Email address fraudulently used to register Apple ID

The password is completely under my control and has been since I got the phone. Since the email address is mine, I can change the password. I can't log in to the website or enable two-factor auth or anything of the sort, though.

That's possible, but it isn't likely.

I'm a network administrator. I've been working in security for the last couple of decades. I never received any of the follow-up emails that you get after an ID has been verified, but I do still have the original verification request. It's almost as if this "Ross" guy entered his email address incorrectly, realized his mistake, and set up his own account with the correct address. Then, three years later when I set mine up, it picked up the old half-entered state of his submission.

But without access to Apple's signup code base from six years ago, I couldn't tell ya...

The password isn't the only hurdle to jump to access the account. When I try to log into iCloud on the web, it asks the security questions (possibly because my account had been locked in the past when I forgot my password). When I try to set up two-factor authentication, it asks the security questions. When I try to reset the security questions, you guessed it, it asks the security questions.

...

Okay. I just tried it again, but this time I canceled out of the security questions. It was showing the security questions because it wanted me to upgrade to TFA, but canceling out let me in. So I CAN get into iCloud on the web, but I can't log in to manage my Apple ID without the security answers.

That doesn't make any sort of sense. I can access all the data but I can't fix the security questions?

Apple wants me to enable 2FA when I log into iCloud. I can click out of that and get into iCloud. I can't log into manage my Apple ID without access to the security questions that somebody else set up way back in 2015.

You're suggesting that somebody hacked into my Gmail account, somehow managed to cover their tracks well enough to hide the fact that my account was accessed from a remote location not under my control, and deleted the confirmation email but not the initial request to verify email? All to create an Apple ID for someone that wouldn't own an Apple product for another three years? And then didn't use that Apple ID for any traceable purpose, other than to cause a headache for someone on the off chance that they might purchase an Apple product at some point in the future and have it display the wrong name?

That's weird and highly unlikely.

I have no problems logging in to my Gmail account. I've never had problems logging in to my Gmail account. My Gmail account has never been compromised, and if it had been compromised, I would have far more important problems to worry about than someone being able to register my email for an Apple ID without having access to my email address.

Again, I've had this email address since 2009. I had no Apple products at the time nor did I have a need for an Apple ID until 2018. I have an email in my Gmail account asking me to verify having signed up for an Apple ID in 2015. I never verified. Three years later, I signed up for an Apple ID using my email address. This time, I clicked the "Verify Now". I immediately received a PIN to verify that I owned the email address.

But sure. Let's go with that "hacker" theory. I'll just create a new Apple ID and start from scratch.