DiDi security issue

I downloaded the Didi app for the first time a few weeks ago and upon my attempt to create a profile with my personal email address I have had for over 20 years, the app gave me an error that my email address had already been used. But by who when I am a first time user? I proceeded by creating a profile with my business email. My first ride and last ride was on Thursday the 10th of June. It was a cash trip of R21. Unfortunately, I only had a R100 note and asked whether the driver had sufficient change - he said he only has a R50 but he will try to credit the balance back to my account like they do on the Uber app. I said I’ll check on my end as well, if it isn’t loaded - I’ll proceed to contact Didi. Days have gone by and it had already escaped me to follow up with the company. However, what reminded me was when I received an email of another rider’s trip in my personal email. Who is this person and why is their every trip receipt being mailed to me? Is this not a security risk? I immediately reported it to DiDi in conjunction with the issue surrounding my change. After a back-and-forth, they inform me to contact the driver directly to query about my change. How does a company divert an internal issue to a client? I’m so flabbergasted. Anyways, I reported it on Twitter as well. They only asked me to email their help department. And yet again, the issue was not resolved. Instead, I was told the driver denies ever taking a cash trip though I sent them numerous emails with proof + receipt. With regards to the security issue - this rider who I have no affiliation with: her receipts are still being emailed to me. How is this acceptable??? I am so disappointed. Here we are, trying to support a company in their initiation stage and this is the kind of service we get? Sies.