What can someone do with your name and address and phone number in order to perform "identity theft" largely depends on what you're qualifying as "identity theft". Regardless of this, it also depends upon what a given service provider requires for identification & authentication when someone contacts them for service on an account or to open new accounts. Sometimes, name and address are indeed all that's needed. Sometimes, it's more. Sometimes, it may arguably be even less.
As for jump-starting identity theft, you don't even need that much. Just a person's first and last name can be enough. For some publicly-searchable databases - government-provided ones, no less - that's all you need to look up records which will contain ridiculous loads of additional PII. You might have a hard time nailing down a particular individual by name alone if theirs is common, like "John Smith". But it's a pretty fair bet that you can easily find whatever you want on a (hypothetical) "Joaquin Sikowitz" without knowing anything else about them. As a particular example, I recently had to search for certain records regarding a traffic incident. Using only a person's first and last name, and a government-provided, publicly-accessible website that requires no registration, I was able to find:
Full Name (First, Last, Middle, Suffix)
Physical Address
Date of Birth
Telephone Number
Driver's Licence Details (Number*/Class/Expiry)
Physical Description (Race/Gender/Height)
Vehicle Description (Year/Make/Colour/Style)
VIN
Licence Plate (Number/Expiry/State)
About the Driver's Licence Number, it's worth noting that these can often be simply derived from other trivially-obtainable PII. A quick Google search will turn up several sites where you might be able to do this with as little as: Name, DOB, Gender. Also be aware that there are (or at least appear to be) zero restrictions against asking for one's SSN over the phone. I've had it done to me several times. Usually this is during a first-time account setup, but occasionally it's also happened for verification purposes where I have a pre-existing account. Where there's already an account established though, it's generally more common to just get asked for the last four digits.
