I didn’t think to clarify the information, but when I asked the service provider if the phone had been used whilst my mind was on other things, they told me that it was last used to access the internet at 2.30pm the following day. It could well, as you supposed, have simply been “checking in” and not actually used.
I had rung them earlier and asked for the phone to be blacklisted. I only rang back to ask for the IEMI number that my insurance service had requested. If it actually was browsing as implied, it might make sense that as Tiny has suggested, they “restored” the phone first and then started using it.
I too was remembering the FBI’s attempts to get one unlocked, before the Israeli’s eventually popped their head round the door. I'm fairly sure Mossad weren’t at the Rusty Duck Wednesday night, hence the question.