I bet it's just a method of getting your info. I think they've already got your card number and they need you to supply them the full details. The truth is if someone as they claimed tried to use your card, the person will not use your email address because he/she knows that order verification will come straight there. I think everyone needs to be very careful of what form one fills online.
Cancelling your card is the best idea mate.