GitHub allows anyone to configure the domain name used for GitHub pages, and
there is no validation of ownership.

If a wildcard subdomain then points to the GitHub webservers it will be served
by GitHub since they cannot establish a connection between a user/org and a
domain.