Hundreds of emailed order confirmations for random strangers were sent to Canadian customers, each containing personal information.