My first personal email I got when my company was doing consumer mail, and I got it so early I got just my last name. When I got gmail and yahoo accounts my wife took it over since it was good for her clients. She got tons of < firstname >< space >< my last name > emails from other people since the mailer threw away everything before the space. It was kind of a pain. They all seemed legit.
Call the number it purportedly came from.
There is no number to call. Shop always sends me the same verification code whenever I get to the checkout page on a website that uses them. The number the texts come from is just 22395, which is just a code used by various businesses to send 2FA texts. The most likely thing that is happening is someone is entering his phone number when checking out somewhere, likely by mistake, or because they don’t want to use their own number. I don’t see how any of his info could be gotten from this.