I've seen this same thing happen for years I used to work for one of the phone companies and it happened loads, unfortunately they were normally older people who just handed the package over, the trouble is the direct debit can be anyone's they only need name, address, dob etc to get it ordered.