Sorry to disagree with the others here but O2 have already admitted there was a breach and the account was used fraudulently, so the only question is how the money should have been repaid.
It should not have been allocated as credit but repaid directly into the bank account as requested.
I have been through a not dissimilar case where a large amount of money was spent on a credit card which had never left my possession and the pin wasn't known to anyone but me, this was refunded to me within seven days and a new card issued.
After following all the correct procedures I feel that Moonless has been poorly treated here.
I would have engaged a solicitor for this, and included their fees in the amount reclaimed from O2.
I feel that the assumption that the customer is always wrong should be avoided when giving advice and a more balanced view taken.
To support Disasters Emergency Committee: http://www.dec.org.uk/appeals text Nepal to 70000 to send £5
Sky Unlimited Broadband - Windows 10 - Nexus 4 Android 5.1.1