I once worked with other people on a github project that was a fork of another project. Upstream had long been dead. One day some other person created a pull request from our project's master branch into upstream.

Result: Our project activity resulted in a "your pull request has been updated" email spam about a pull request we had no control over.