It was an old address forwarded to me by USPS. But the address could have only been associates with my ColdCard purchase, so I'm taking the same steps with CoinKite after I did when my email address got leaked in the Ledger hack: I'm not buying from them anymore.