You’re right about AI - it doesn’t exist and is decades away, what we have are increasingly capable statistics engines, aka machine learning.

A for the topic, that’s easily worked around by having domains with catch-all addresses and a script that just clicks any registration link that comes in. Of course such domains are easily spotted and blocked, but domains are cheap as hell, and there are undoubtedly plenty of botnet nodes on hosts that can receive mail du they don’t even need to register their own domains at all.