Activating sims in someone’s name without their permission is an invasion of privacy. For example, in 2018 the Privacy Guarantor sanctioned a Tuscan retailer because some of his sub-agents did it, independently, to collect commissions on those customers.
Other investigations by the Guardia di Finanza have instead discovered illegal activations of SIM cards, registered to unsuspecting users, with the aim of using them for criminal activities. A SIM in the name of a third party protects the identity of the real user, who can thus manage illicit trafficking (drugs, for example, or scams) over the phone.
The user should disavow those sims in writing, declare that he has never activated them. Good if you communicate it to Vodafone. However, you could also file a complaint with the police for abusive use of your personal data.
If that’s the case, you’re also entitled to a refund. To obtain it (if the operator denies it) he could activate a free conciliation procedure on the Conciliaweb site.