As X expands into payments, users are receiving password-reset emails they didn’t request. Here’s what may be happening and how to stay safe.