Obvious next step to me is malicious bills sent to an address

You are a bit late with that idea: https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentence...

Only worth it for a targeted attack. Even then I might just read the number off a genuine bill instead of their fake one. And that's assuming they have linked my address and number - lots of scam calls are low effort dial every number.