Att sold me a used phone when I purchased a new phone

I bought a new iPhone from my phone network (att) and as it turns out it is not new at all but a refurbished phone someone returned to them that they put back in the box and sold as new ? Wtf? I have been getting text messages and emails for some other girl since I got the phone from her drs credit report people fed ex and ups . It’s kinda concerning . Does this mean when she logs into her iCloud account that it’s through my phone? What exactly can she see of my info? Does it mean I don’t have security or privacy?