If a new user lists a secondary email address when creating a Gmail address, we automatically send a confirmation message to that address. Unfortunately, users often misspell their secondary addresses, so the confirmation message is sent to the misspelled address instead of the user's intended address.
This confirmation message is not an indication that your address has been compromised in any way. If you receive a confirmation message from Google regarding a new Gmail address that you did not create, you can safely disregard the message.