I’m seeing emails for a few services at my primary personal gmail account that I don’t know anything about, e.g. A shopify trial account in the Germany region (I do not live there and I've never signed up for a Shopify account) and an account on a ticket resale site that I didn't know existed.

I don’t understand how someone could have done this without being able to verify the account by receiving and clicking on an email, yet I recognise every device/access on Google’s list of devices. I also have 2FA enabled.

I've obviously changed my password and invoked Shopify's 30 day delete on my PII - the trial has expired so I cannot get past the "pay us money to do anything" wall and delete the shop myself.

What could I be missing? Could this be someone with remote access to one my devices and able to defeat 2FA?