Pretty common practice with leaked login info. Also generally they’ll email bomb you after ordering to try to hide the order email. They’ll even try hitting every site imaginable with the same combo. This is why I love “hide my email” with Apple. Different generated emails and passwords for everything with a tap.