It sounds like you got the correct answer from the security team the first time you called? If a customer mis-typed their SSN and accidentally got yours, but the name and address on the return were their name and address, then it's probably ok to just call it a typo (especially if the customer fixes the SSN and re-transnmits.)
Turbotax automatically puts a hold on any tax return from a new account where the SSN matches an existing customer. I would assume (perhaps optimistically) that such holds are manually reviewed to separate typos from real ID theft. But because the IRS puts strict time limits on such holds, it probably makes sense to notify the customer ASAP instead of waiting until after the manual review.
