Yeah, it could be a middle man shipping person... but this smells to me more like the middle man shipping company itself might have been hacked - exposing past invoice data.
It's great that Coinkite delete's user data, but they can't control the deletion of the data that they had already passed alo...