I got a Private Relay account without asking and with the function off

Browsing on my iPad yesterday looked in on family tree website to see what it offered. Wasn't taken by what I saw with a quick trial search. Did not activate an account, enter details etc.

Toady I found welcome to your family website and your account. The account was identified by a Private Relay email address along with a password ********.

Firstly have not used, or even looked at, Private Relay and the function is set to 'Off' on my Mac, my iPad and my iPhone. So what created this PrivateRelay set-up?

Secondly the only way presented to close the unwanted account and website was to confirm deletion by entering the email used to create the account, possibly my Apple ID, and the password which was completely unknown to me and untraceable.

So how can this happen? Is it some fundamental breach of security?

FYI - I have contacted the customer support of the website and have, eventually, got the unwanted account and website closed.