How did someone manage this hacking/identity theft and what else can we do about it?

While on amazon.com yesterday, I noticed a strange shipping address listed in our account. Someone had used our Amazon account to order an X-box to be shipped to an address in CA. They used a credit card in my husband’s name (with our address from five years ago as the billing address) to pay for the order. I changed our Amazon password and contacted Amazon, who is investigating from their end. We tried to contact the credit card company listed from the payment on Amazon (we can see that it was an AmEx card, which we don’t have), but they said the card must have been issued by a bank or something because they don’t have any listing of an AmEx account with the name and address used.

Also, we checked our credit report and there is nothing strange on it. Maybe it’s too soon, because this order with Amazon was only placed a couple of weeks ago.

What bothers me is, someone had to have not only my husband’s SSN to get the credit card in his name, but also our email address and Amazon password. We’ve changed passwords on any accounts we use that email for, and can see that our bank accounts are fine. What else can we do? How can we track down this credit card account without knowing exactly who issued it? Any other steps we should take?