What can someone do with the last four digits of my credit card number, last four digits of my social security number, and my zip code?

Those three numbers are the most common ones used to verify the identity of someone who already has an account with the company in question. If you call customer service for a company that has your credit card, they'll ask for your last four to "confirm" that it's you, and possibly your zipcode. If you call your bank, or a government agency, they may ask for the last four of your social.

With just that information, they won't be able to open a new account in your name anywhere, or charge anything to your card. But they can use it to "prove" that they're you to some other organization which then may give them more details, which they can then use to do something more malicious.

See this article and this one for some high-profile examples of how a small amount of personal information was used to convince companies to give more and more, until the attackers were able to completely take over.

Unfortunately, unlike when your numbers are outright stolen, there's not a lot you can do directly to protect yourself. You should enable two-factor authentication on any service you use that permits it (especially your email), and possibly contact your service providers and see if they can put a note on your account with them that they shouldn't permit any changes or provide information (and then don't get into a situation where you would normally need it).