To my reading, there are two likely possibilities. (1) Someone has illegitimate access to your information and is trying to trick you into giving your CC or money in some other form; or (2) someone in MEX with legitimate UA credentials is running an illegitimate side-hustle to arbitrage or otherwise pocket some cash.

Neither one sounds like something I'd want to be involved in.