Wanted to share an update in case this helps anyone else, because this was seriously confusing at first.
I got a legit Southwest confirmation email for a weird LGA to DAL to ABQ trip, about $1200, booked in my exact name and sent to my personal email. No Rapid Rewards number attached, and the credit card used didn’t match any card I own. Naturally I freaked out and assumed some kind of identity fraud.
I called Southwest and the agent walked through everything in detail. Turns out the most likely explanation is way simpler and less scary: the actual traveler has the same (very uncommon) name as me, but whoever booked the ticket mistyped her email by one character and accidentally entered mine. DOB on the reservation didn’t match mine, which helped confirm that.
Southwest removed my email from the reservation, added notes everywhere documenting the issue, and switched the traveler’s contact info to her phone number so she’d still get updates. The agent also said she was glad I didn’t cancel the booking, because that would’ve canceled the traveler’s trip without her ever knowing why.
So no hacked accounts, no stolen ID, just a bizarre typo collision. Huge relief. If you ever get a flight confirmation that looks real but doesn’t touch your card or loyalty account, call the airline before doing anything drastic.