"She also said that the data did not include financial data or national insurance numbers, so the department did not feel it needed to contact the individuals concerned, although a helpline has been put in place"
I'm not a sneak thief, but given the information present in the archive, it can't be too hard to e.g.
1. Telephone a person on the list;
2. "Excuse me, I'm calling from the DVLC, I believe back in 2004 you undertook one of our tests at (name of centre). You paid £X with your credit card - we have subsequently audited our figures and we actually owe you seven pounds fifty, could we have your bank details please. If you want, you can call us back on this official-sounding number";
3. Repeat two million, nine hundred and ninety-nine thousand, nine hundred and ninety-nine times.
Obviously the government has put safeguards in place to stop this from happening, and it's wildly and completely implausible (cough), but just imagine!