Anyone else just started getting spammed with random signup verification codes for random services?

This is a classic attack, spam the end user so they don't get the email showing a password has been reset for a compromised account. Assume compromise already and start resetting passwords and logins, ensure that 2FA is configured (at a level over emailing you directly). This needs to be done from the highest risk level and start working down. Then kick off a further investigation for any indications of compromise. Check for any aberrant logins for this account, redirects\\forwarded emails etc.