According to validator.js codebase, it only checks if top level domain (tld) matches the specific regexp. And as tld list can always be extended via new registered items, this seems to be correct solution. So, commmmmmm is something that might be a tld, and that's why validation returns true.
Other solution might be to check if tld is in registered tld list, you can use tld-list npm package for that:
const tldList = require('tld-list');
tldList.includes('[email protected]'.split('.').pop());
But this solution requires constantly update this package, to be able to track new tld's as well.
There is also a validate-tld package which does request to the registration service to check if tld is valid:
var validateTld = require("validate-tld")
new validateTld().validate('commmm').then( console.log )
Hope it helps.