Unless the person who sends them to this wrong address realizes it and creates the account, they remain in "limbo" until claimed.
Thank you for bringing this to my attention, I didn't realize this is how it worked. Seems strange that the tokens would just "float" there until an account was created to complete the transaction, the tokens really should be returned. Seems more like a design flaw than a loop-hole, although this design flaw is being EXPLOITED to collect ill-earned (stolen) gains.
I would support any petition to fix this. !DUO
You just got DUO from @ironshield.
They have 1/1 DUO calls left.
Learn all about DUO here.