ndrs, about those capital letters don't know why, i asked the bank same question and they didn't know neither, my guess is, if someone try to hack anything at least they would do it right, apart i have that sms security thing with my bank, so it seems at least quite unlikely that it has been a cyberattack, apart that saferplay thing they have in their website seems quite stable to me.
I completed the order thru their web precisely 00:45 on 12/4, so that's right, and it was the first payment, the one with the vat. The second one without vat that you see at 00:00 was charged to my account 19/4 with 12/4 00:00 date, so it was charged a week before the first one but with the same date as the first one.