Assuming someone knows your name, address, and SSN (something which isn't meant to be secret - the SSA even printed 'not for identification' on the cards for a while), they can apply for credit cards in your name as they often require no other form of identification. The U.S. doesn't have a national login system for identity verification or anything so there's not much that could be done here from the security aspect besides creating a federal credit beurau or a federal ID system (or if login.gov allowed third-party companies to use it).
That's kind of what identity theft is, and it is distressingly possible.
It is possible and it happens. This what ppl mean when they talk about identity theft.