It is also criminal offence to open post not addressed to you regardless of whether it is sent to your address (under data protection act).
Section and quotation please. (Hint: it isn't there. I really hate when people throw around the Data Protection Act when it doesn't apply.)
I encourage the OP to contact IRCAS on the matter. I don't know if it has access to credit records, but if it does, it can put a default against the address which may (but also may not) become associated with anyone else at that address who applies for credit in future. That is probably an outcome best avoided.