That's the reason you've flagged your credit reports - you don't want a criminal getting instant approval and getting new credit cards in your name sent to them. I've been the victim of identity theft before (a temp worker in personnel stole the identifying information on all city employees). Worst I had was a cell phone ordered in my name, but others had accounts set up at big box stores and appliances and computers ordered in their names delivered to addresses they don't live at.

I still applied for credit while the credit report flags were in place. I'd receive a postcard in the mail within a few days with the denial, then call in by phone, answer a few questions, and get approval. Yes, a little bit of a nuisance, but much better than dealing with closing accounts opened fraudulently in my name.

I'd take a look at the FTC website and think about reporting it there, also:
https://www.identitytheft.gov/