This is exactly what happened! There was a Wayfair order for an $800 faucet. I did catch it, because I get Wayfair texts, and they used my phone number and name. I was first alerted when I got a text asking to confirm I no longer wanted text updates from wayfair. I selected "resume" so I could continue to get the updates. When I got home I saw the thousands of emails and sure enough one from Wayfair confirming my order. I immediately called wayfair and told them the order was fraudulent, and had them remove my credit card number from saved numbers. I logged into my credit card account and the wayfair one was the only charge. I've kept a very close eye on my CC statements and no other charges have appeared. I called police and gave them the address the hacker used to deliver the faucet. They took a report but I doubt they followed up. I had to call wayfair back 5 times to get my refund and stop the order. They eve n shipped it after I told them it was fraudulent, and did not stop the shipment. I got another text saying "your order is out for delivery" after multiple calls I believe I stopped the crook from getting the $800 faucet but it was way too much work on my part. Wayfair should have done a better job of stopping it.
So anyway, I don't know if they hacked into my wayfair account or hacked into my email. Either way I've changed all passwords and continue to check daily my statements. Now I just need to deal with the constant barrage of emails from all the places I "subscribed" to. The biggest problem is I continue to mark them as spam yet I still get them, like the system is not detecting they are spam.