The last four digits of your credit card should not be considered secure information. It's printed on all of your receipts. You carry it on your person in plain text. Many of your online accounts will display it in your account settings without an additional login. It's probably in both your mail and your email. Once someone has it, they can use it for years for recovery on any service that accepts it, and I know some will allow full account recovery using it alone.