[mothered]

That is really strange! Must mean they can see the MAC address

The MAC address on your "device", doesn't travel beyond your local/Internal network.

For Instance, when your device connects to your Router, It's the "Router's MAC address" that's active. When the Router connects to your ISP and then the ISP establishes a connection to a server on the Internet, It's the "ISP's MAC address" that's visible.

Yep everything  the only similarity was that I refunded it on the same device

They may have Identified some sort of fingerprint- Canvas, WebGL, WebTRC etc.

Use another device and you'll be fine.