Another possibility (even though it sounds unlikely given that the card might not have been used) is that the terminal was forced to allow swipe of the card. This can be done pretty much anywhere by inserting the card the wrong way a couple of times. Cloning of the magstripe is still possible as a result.

Of course, if that were the case, then Citi still needs to be better at the whole customer service thing and not claim that the chip was used.