Is the virtual card number single use? I’ve never used one before. If not, maybe another site it was used on just leaked it along with the shipping address. Edit: Oh, that’s basically what you assumed. I tend to reply before I read more than one sentence :)