Someone would have to figure out who to call an identity thief, who purchased the goods, who to send the bill collectors after, who to serve for a lawsuit, etc.

All the company has is an email address and a bunch of other incorrect information.