Citicard changed my address to my neighbor's

Today, my neighbors received a piece of mail from Citicard addressed to me but to their apartment number. It was a letter to tell me that my statement was available online, which is stupid. My account number was in the letter. In January, I changed my address online to a post office box. Somehow, Citicard changed my post office box address back to a physical address. Whoever manually typed it in, he/she typed in my neighbor's apartment number instead of mine. This is a serious breach of security. If there was a question about using a post office box, they could have contacted me. What if my neighbors were not honest people? They could have used my credit card number. Of course, when I email Citicard tonight, I get stupid handbook answers from someone overseas.