We're talking about a credit card that can only be used at Sleep Country, right?
Having a secondary cardholder added onto a credit card account is a rather simple process, actually. All this guy had to do was grab your account number (most likely off a bill), type up a letter and sign it as your name. Generally, credit card companies simply don't have the resources to cross-check signatures.
The upside to this process is that the card is only sent to the address of the primary account holder (which is why you received the card). And without the card, he can't use the account.
Don't worry about changing your credit card numbers (especially not any Visas or Mastercards). Both Visa and MC have a zero liability policy, meaning you're not responsible for any fraud charges.
Just keep an eye on your statements and if you see anything out of the ordinary, give the CC company a call and have them cancel the card. Any bank can get you a brand new card delivered to a local branch within 2-3 business days.
And don't worry about identity theft at this point, especially if your credit report is clear. This appears to be a case of a low-level fraud attempt from an uneducated fraudster.
I worked at Visa for 3 years, including a stint in fraud prevention, so feel free to ask any other questions
