You can still verify your domain on GitHub to prevent this from happening but this only protects itself and its immediate subdomains, so keep that in mind (and never create a wildcard DNS record for GitHub).
This just happened to me because I always assumed that your <username>.github.io domain was some sort of restriction, but it's just a wildcard entry to the same IP address.
@uwunetes I feel you. I wanted to have some simple api analytics (total requests, ...) and ended up using an influx database: https://t.co/iKcqafRs7N, but not as good as something like umami or plausible for client side analytics.