How to handle unknown person added as website owner on Google Search Console?

Do they gained access from html-tag verification as well? Mine did that, I remove them immediately. Indeed, it’s some kind of automated script injected to html DOM or something.