Two months ago, I posted a thread about Apple allowing iCloud accounts to exist for my domain that I hadn't created in the first place:
https://news.ycombinator.com/item?id=33756458
That behavior seems to have changed now. Apple now seems to require email address to be verified before the iCloud account can be used:
https://imgur.com/a/ZVBf1ZZ
I don't know when this change rolled out though.