Similar thing happend to someone I know.. up to the tune of £3,000.. someone ordered 10 (yes ten) digital vid camera's to be delivered to an address 200 miles away!... when asked why they had let anyone use the account to deliver to an address that was not the account holders they said that sometimes people send gifts to friends..
Seems obvious that someone within these companies are giving out info to thieves.