First, RFC 2616 is obsolete; you should be referring to RFC 7230 and RFC 7231 instead.
(RFC 7230 § 5.5) HTTP servers which receive the absolute form of a URI in the request-line ignore the Host: header and use only that absolute URI for any further processing. The server then has to decide what to do with it.
Existing general purpose HTTP servers use virtual hosts to provide service for several different hostnames, and if the given hostname does not match an existing virtual host, they will attempt to serve it with the default virtual host. Unless the server has been explicitly configured to proxy such requests, but this isn't in your scenario.
While the RFC does note that this situation can occur, it does not mandate a particular response. If you are implementing a server capable of serving virtual hosts, you can do what other servers do and serve it with the default virtual host. Or you can decide to refuse such requests and explicitly serve a 403 Forbidden. (RFC 7231 § 6.5.3)
The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it. A server that wishes to make public why the request has been forbidden can describe that reason in the response payload (if any).
The 406 and 409 errors you mention aren't intended for this scenario.
(RFC 7231 § 6.5.6) 406 is intended for the situation when the server found one or more documents matching the URL, but none of them have a MIME type matching any type given in the request's Accept header.
(RFC 7231 § 6.5.8) 409 is intended for situations in which the data being uploaded can't be processed due to a conflict with existing data, such as a version control merge conflict.