Someone, or however it's being done, is ordering things from all over the internet, using my son's old email address.
He no longer uses that address, however, they are placing orders to our address.
So far the orders have been declined due to incorrect credit card info. Nobody can really tell me what to do. If I delete his old email address, should that end this? How and why does this happen?
The first question that comes to mind is why someone would order something, using your son's email address and ship the order product(s) to your address.
In my opinion, fraudsters can be ruled out because there is nothing gained by shipping the products to your address.
Second, how sure are you that the old email address is no longer used by your son? Does it show "last logged in from" information? If so, does this match your IP address / location?
How is the email address protected? Meaning only by a username and password or is there also two factor authentication in place?
Is your son's old email's password used in other places? If so, change the passwords for all of the accounts that use the same password as his account could be compromised.
Deleting the email address will destroy any evidence, however, changing the password to his old account would perhaps be a better option.
Why this happens? Well that's just a wild guess. Could be anything from your son trying to see what happens to a friend who's pulling a "joke" on him. As mentioned before, I doubt it's a fraudster because it doesn't make sense to ship product to your address.
This is perhaps not what you wanted to "read", but I've seen crazier things happening.
