This doesn't surprise me: on a SaaS service, we already had people contacting us like "hello, someone on my company is using your service, could you help me locate them?", and it was not scam, a genuine person lost in their own company.