You were lucky and right.
To my shame - I had completely forgotten I had used them many moons ago and at the time they wanted to pay the money for my stuff direct into my bank account. Which I foolishly gave them. I recieved the email this morning.
Had no idea I even had an online account with them (which I have never used). I reset my password so I could log in and rather frightening event though my address information isn't there my bank details are! I don't remember giving them permission to put that information online...
Bollocks is all I can say.