What Can I Expect Moving Forward?

A fraudulent credit card was opened with my name/SSN/phone/email, but incorrect address. Luckily I monitor things and quickly saw a change, and was able to cancel the CC before it was delivered to its destination. That said, there is still a CC activation fee showing up, for which I received a statement. I filed a police report, worked with CitiBank (as much as I was able to - they fucking have SUCKED during this process) to close everything. The credit card wasn't picked up at the P.O. Box it was sent to, and was apparently returned to CitiBank or something (again, their service through this has FUCKING SUCKED).

My question is this: what can I expect moving forward? Obviously all of my stuff is out there enough that the first attempt was possible? Should I expect a flurry of additional attempts with other banks/credit cards? Or is is possible that whoever tried this first time will simply move on to the next victim? I have no clue why the person didn't pick up the credit card at the PO Box - potentially they knew it had already been reported fraud...and if so, that scenario is also scary to me.

Is there any insight into, generally speaking, how people get of hold of this data to begin with, and how they pinpoint or target an individual person? Is it more scattered or thought out/deliberate?

Any other actions I can take to mitigate the chance of this happening again in the future?