I think you're misunderstanding. They used the OPs email address and their own payment info, aka a 'joe job', it looks as if the OP is the one defrauding customers, but actually it is - probably, that could be yet another level of misdirection - the owner of the bank account in Russia.

I don’t think I’m misunderstanding. Since when is an email address used as a legal form of identification? If anyone can use an email address to sign up, OP isn’t liable for that.

They’re best off reporting it and ignoring it. Unless, of course, they used OP’s payment details.