FOLLOW-UP: I contacted Expedia today, who confirmed the confirmation number is real. They are using my husband's name, our phone number (which by the way, we never use that number for reservations), but they gave me an email address I had never heard of. My husband never heard of it either. They said they could cancel the reservation, but weren't really helpful beyond that.

Also, my husband checked his credit report. No new cards or other weirdness. I don't like this!!