That's probably exactly what's happening. A few years ago someone started trying to open credit accounts in my name. Eventually I found out that just before then, someone had checked my credit report a few times via an online monitoring service.

I think it works like this: the thief has your SSN, but needs more information about your accounts (and your life in general) to plausibly pose as you when opening a new credit account in your name. Info in your online credit report isn't quite complete (i.e., only partial account numbers), but there's a LOT there. So, when he has to answer identity verification questions like "which of the following credit cards do you own?" he has a good chance of getting them right.

Back on topic: I've sharpened the edges of my expired CSP card using a knife sharpener, mounted it on a nice wooden handle using a couple of #8 bolts, and am ready to use this preparation to excise a certain part of my identity thief's anatomy, resulting in a dramatic reduction in his testosterone levels. But first I need to find him.