Should I be worried about these conformation codes I didn't request?

A user received a confirmation code for X or Twitter related to a phone number not connected to their account. Later, they also received multiple Facebook emails containing confirmation codes—eight times within 15 minutes—which the user stated they did not request or use. The user has changed passwords but remains worried about potential security breaches.