I received this e-mail today:
Subject: [WordPress.com] Password Reset
Someone has asked to reset the password for the following site and username.
Username: <my OpenID user name>
To reset your password visit the following address, otherwise just ignore this email and nothing will happen.
https://wordpress.com/wp-login.php?<blah blah blah>
The e-mail address it came to is one that I set up with gravatar.com when I created my awesome avatar1, and I haven't given this e-mail address to anybody else2.
I don't recall ever having visited WordPress.com, and I certainly haven't tried to reset a password there. In fact, the only time I read blogs is when they come up in a Google search of a problem I'm having. If this site uses OpenID (which I assume since the user name they mention is the one I use only for OpenID), why would they even have a password for me to reset?
So the common links are OpenID and Gravatar, both of which I've only used for StackOverflow and friends. Has anybody else seen something like this? Has my OpenID/Gravatar/StackOverflow (and friends) login been hijacked?
1. That's one of my incredible sons—my youngest—in a monkey costume for Halloween. He's very expressive.
2. I run my own mail server, so whenever I have to give my e-mail address to a site, I create an alias just for that site. That way, if I get any spam, I can drop that alias and I know that I can't trust that site.