Seems like GitHub could solve this by making users verify they own a domain name by adding a value to a txt record rather than just seeing the domain points to github and letting any repo use it.

>how long it’s been abused?

I would say probably 10 years, I remember reading about the CNAME github issue around 2015 or so, as before that most used to use jekyll with gh pages, was bery popular among indie developers

You told your NS to forward any request to GitHub, a platform you don't own.

I think this is the expected outcome.

It's good you noticed and shared your findings, but to me this "works as intended"