Email address changed without my consent

Vodacom have been sending my statements to a random email address and are telling me they don’t know who changed it. So for the last 8 months my statements have been going to some random person with all my confidential details on it. The worst part is that the call centre agents don’t see this as a problem or that they don’t know who changed it. The sad part is for me to talk to anyone I have to go through multiple layers of security but they still somehow changed mine with no authority.