Is there a general best practice for this? We already scrub sensitive
information when using data in our test environments, but what about
scrubbing less sensitive information such as email address or phone
number?
Most shops have practices for using test data. The specifics differ, but in general you don't want to use Production data which would be illegal, called out in an audit, could be embarrassing to your customers, etc.
Some locales require special handling for PII (personally identifiable information), so check local laws.
In addition, some audits will ask about the handling of such information, so check with your company's standards.
But your customers received an unintended notification due to your failure to scrub data that you have deemed "less sensitive".
In order to prevent another occurrence (which would be particularly embarrassing), you might consider reviewing your test data practices with an eye toward "escape" rather than just protection of PII. Ask yourself, what could possibly happen with the data as it exists. If your system involves automated calls, for example, phone numbers might provide a means of "escape" and hence should be scrubbed.
Additionally, do you really need to use a scrubbed copy of Production data? In many cases, synthesized data (which you could generate in an automated manner) is better than a copy of Production anyway. Synthesized data can be seeded so that it exposes test conditions that may not occur with a snapshot of Production. For example, my synthesized data usually includes at least some cases where fields are filled to their maximum length - a condition which might only occur in production by happenstance.
Besides the data, look at your test environment itself to see how you can avoid such escapes in the future. Does your test environment actually need to deliver emails across the internet? Or could it be set to either just queue up the emails without delivering them, just dump them to the file system, or block delivering them to the outside world?