Credit Karma creditkarma.com They will give your credit report to anyone claiming they're you, except you San Francisco Internet

From what you have described you COULD be a victim of Idenity Theft, and need to immediatly take action to minimize any possible effects or consequences.

You say that they did not provide you with information on who obtained your credit report.  That is FALSE, as far as they are concerned YOU were the one who obtained it because it was your information.  They also gave you an e-mail address(of course it was a "free" generic email address), but it is what information they have.

If someone has enough information to get your credit report, they have enough information to do a lot worse things.  Such as open up lines of credit or bank accounts in your name.  They could also get your credit report from any other company as no company requires you to send in additional proof if you can answer the questions on-line.  The reason you are being asked for additional verification is because there is now a question as to identity...after all YOU could be the Identity Thief(and no I am not saying you are).

What you need to do is get your credit report from the actual credit reporting agencies.  You are allowed 1 free per year and you can go to Annual Credit Report dot com(in case the link below gets redacted). 

https://www.annualcreditreport.com/index.action

Any other site is NOT the official site.  Now, you won't get your score, but at this point your score is the last thing you should be worrying about.

You then need to contact one of the 3 Credit Report Agencies and put a "Fraud Alert" on your report.  This will basically alert you to any attempts to access your report and require additional verification that you are aware of it for a period of 90 days.  This is FREE, so if you are ever asked for a fee for this service you are at the wrong place. 

You then need to file a Police Report for Identity Theft and you can then change your Fraud Alert to an extended fraud alert which is valid for a longer period of time. 

If you find any fraudlent activity on your report you need to start disputing them and trying to get them cleared up.