I have found a valid DL IP address
I send them a HTML email with a image in it hosted on a little web server I set up on one of my PCs using DynDNS.org. When they opened the email, their email program downloaded the image and I recorded their IP address!
It seems their security is pretty lax. If I had time I'd go to London just to check that all their wifi APs are using proper security.
Anyway, I'm not sure what I should do now. I could just copy their letter and replace my details with theirs... But that might be copyright infringement of their letter. Also, if they refuse to pay I'd be forced to call them on it and take them to court, which I'd love to do as it would either force them to loose (massive PR win) or force them to defeat their own evidence (epic legal win), but I don't have the money to do it myself.