"I've been receiving emails sent to firstname.lastname@example.org. We don't even have an account for that address. These emails look legitimate, but I don't know. Should I open them? Are they junk?"
In a word? Yes. They're junk mail – or worse, spam.
This is what we call a "phishing attempt" – blasting out several respectable-looking emails to email addresses that may or may not exist. If the email is opened, that address is considered legitimate – and added to a bunch of spam lists.
Spammers who do this "fish" for email addresses like email@example.com, firstname.lastname@example.org, email@example.com, and so on. If you don't use an email address like these, dump anything you get sent to them in Junk Mail. If you have generically whitelisted your domain (i.e. *yourdomain.com), delete this whitelist item. It allows any emails sent to your domain to pass through the SPAM filters without being checked.