I think that's most likely it. It has to be checked out though. Somebody in the supply chain is doing some shenanigans on the side and can't be trusted.

Yeah, it could be a middle man shipping person... but this smells to me more like the middle man shipping company itself might have been hacked - exposing past invoice data. It's great that Coinkite delete's user data, but they can't control the deletion of the data that they had already passed along to someone else. To me, the bottom line is, there are no guarantees: act accordingly. *and in this case, it sounds like the appropriate skepticism to an unexpected correspondence was indeed applied. PS. It does seem like Coinkite should take more of an interest in determining if their shipping partner was the weak link here or not. Maybe behind the scenes they will/are. 🤷