I know with many accounts, they will try to verify you another way - if you have date of birth, address, that is usually enough. From there, they can get some generic account info to use that information to do what they did - good you figured it out!