I don't believe 2FA is ever required in the context of setting up a direct debit - or have I missed something?

Having navigated many consumer ISP online ordering systems generally required are a valid account number and sort code, and often a credit search is undertaken.

All sounds very strange.

Umm. You could be right; I may have been thinking of setting up a BACs payee where this definitely happens, but even if I was wrong about that if the order was placed online or by telephone there would be at least two emails resulting in real-time. Maybe moved to Deleted/Junk/Spam folders by the person responsible.