and when I visited the website, there was an open order for a PS5 with delivery to:
After logging into Macy’s I got 43 emails at once to seven different services
Did you manually navigate to Macys.com, or did you click a link in the email to “Macys.com”? Because it’s a common phishing technique, they may have used your macys email and password to password spray every other website they could find it associated with when you “logged in.” It’s usually a page that’s spoofed to look like a legitimate login page, which redirects you to the actual page once it records a login attempt.
Also check HaveIBeenPwned.com, your email may show up in a few major beaches, which is enough for script kiddies to spray it across the entire net.