I haven't been scammed like this, but I know to check for stray dots in incoming mail's To field because there's someone who was granted my email (with a period in it) and I keep getting their mails (holiday photos, amazon emails, and just recently, a belgian second-hand item-selling platform). So it doesn't surprise me in the least that someone is taking advantage of this. If google had even an iota of one good programmer left, they'd change this. But apparently not, because this great big hole has been there since the beginning, and will likely stay there until the end.