Does apple automatically sign out all connected devices when you change the apple id password?

Question

Yesterday, I got a bunch of emails from Apple, sent to one of my unused gmail addresses (which still has forwarding to my regular one). I do NOT have an appled ID associated with that address, but it seems like someone was trying to create one.

They were (all in English unless otherwise noted):

• 10-12 identical "Verify your Apple ID." emails from [email protected], some in English, some in Greek (I'm Greek and in Greece, so this makes some sense).
• "Your apple ID has been used to sign in to iCloud from an iPhone 4s." email from [email protected] (not sure about wording, because this one was sent in Greek: Το Apple ID σας χρησιμοποιήθηκε για σύνδεση στο iCloud από iPhone 4s.)
• "Your apple ID information has been updated" from [email protected]
• "Welcome to iCloud" from [email protected]

I was alarmed by this. I'm 99% certain I did NOT ever create this apple ID, and 100% certain I didn't use it yesterday, from an iPhone or elsewhere. I went to the apple site, clicked on "reset my password", got a password reset email right away, and changed the password.

I checked ALL my gmail accounts (the one used for the ID, the regular one & a secondary one I have) and there has been no sign of breaching - no connected devices or recent sign-ins I don't recognize, no auto-forwarding or suspicious labels created.

Today, I received another email from apple

• "Your recent download with your Apple ID." from [email protected]

I therefore realize that the device has somehow not been disconnected, although I believed that, as with other services eg. Google, whenever you change your password, each device asks you for the new password when automatically signing in. Is this not the case with Apple?

To rephrase, does Apple automatically sign out all connected devices when changing your password?

I also had to install iTunes, so that I could deauthorize the devices already connected, but the option does not show up on the list, which seems to mean there are no devices associated. The only method I found for doing that without using iTunes did not work properly.

The details which the person has entered to the account associated with my email seem legitimate (as in, non-spam/scammy) but it looks like they're not tech-savvy enough to even realize they're using the wrong email, so I don't think contacting them (they've even listed their phone number) would have any benefit.

Is it really possible for someone to register for an Apple ID and continue using that ID without verifying the email? Because this is what seems to be happening. I never clicked on those "verify" links, they even look unread in my inbox, but it seems like this person is still using that ID.

My goals here are

• To make sure my email account is safe
• To stop receiving annoying emails every time this person does anything related to their apple id.
• To ideally stop this person from signing up for apple IDs or other accounts using an email that doesn't belong to them (and can possibly be a typo, judging by their name).

Any help/feedback at all will be greatly appreciated.

Answer 1

does Apple automatically sign out all connected devices when changing your password?

If they are still signed in (at the time you change the password) it will not sign them out, but next time they will have to use the new password to sign in.

Your problem is clearly with someone who cracked your old gmail account.

Now they have created NEW apple id and can verify it since they have access to email.

• go to that gmail and change the password to a strong one.

You only got a copy of that email since you have the forwarding turned on.

You must have created a apple id once upon a time since it is needed for basic service like system software updates.

Your original apple id might be still OK and not compromised (but change the password on it anyway).

Answer 2

I called the (local) number this person had listed in the apple ID and talked to them. Apparently, it was just someone that thought they were registering FOR that apple ID/username, not realizing they were stating that this was their email instead. The emails received (there was an additional one from a university), their age, as well as their attitude on the phone made me pretty certain they were truthful. They just thought they owned that email account, without ever managing to log in to it.

So it wasn't a phishing scam, or any account breech.