Millions of phone calls from customers were "likely mishandled" over nearly a three-year period, the regulator says.