That was my guess, too. However, Apple seemed to think there was no relevant session activity on my account at the time. They stopped short of confirming that

That was my guess, too. However, Apple seemed to think there was no relevant session activity on my account at the time. They stopped short of confirming that the payment and shipping info was entered manually. When I asked directly, they initially said they’d put me in touch with the fraud team, but the fraud team refused to talk directly to me and would only talk through another support rep. They refused to answer any questions about how the order was placed.