My domain got abused on GitHub Pages

My domain got abused on Github Pages — Roland Meertens

How a wildcard DNS record pointing at GitHub Pages let strangers spin up scam subdomains on my own domain — and what should change.