On average, zero per day, maybe 5 to 10 per year.

I'm really surprised that it's more than 1 ever.

At scale, there are a lot of confused people who do unexpected stuff. The maintainer of cURL has people contact him when a notice shows up in car software or when they think he is connected to hacking: https://daniel.haxx.se/blog/2018/02/16/why-is-your-email-in-... https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/

At FSF, someone would call every month thinking they had been "hacked" and that FSF was responsible because they found "evidence left behind" (the GPL).

This is gold :) I wished you share more of this stories