Defcon, when they said they were going to send a text they said the last 3 digits were 123 and that was correct, you mention email changes show last 2 digits, but I am going to go with your resolution.
..of note, the last time they called was also just after calling repair, and also my email name and landline phone number are probably only together in databases, I have an alternate for non secure give out.
Thanks everyone for your input.
Lessons.
1) always hang up on a noisy background call from afar, especially fast talking ones
2) never use your name as an email name, at least when it is going on a database. That way they can't ask for you when they call. (depending on how they got your data of course)
3) use different passwords for email and BT login.
4) however tempting it is, don't spent ages with them deliberately wasting their time ( oh, I thought you said F not S, now we will have to start all over again)
5. be suspicious of any calls from withheld numbers, numbers starting 00 or indeed any call where the caller is not identified by a friendly name (i.e. they are not in your contacts list)
6. It's handy to be multi-lingual, that really p155*5 them off
Also, I was unaware of BT 2 stage authentication, it was off. If it would have been on this would not have happened, this feature presents a second password challenge for non-registered devices. It wont stop them if they have hacked into your PC though. I believe BT is going to change the PIN text for password changes to instruct this pin is not to be given to an agent.
Sorted.