This finally all caught up with me while I was away. Amex declined a Spotify authorisation and asked me to confirm whether or not it was me who'd tried it. Although I didn't confirm the attempt, Amex then authorised a second Spotify attempt. Amex then further authorised a £150 charge to DesignMyNight, which wasn't me either. All of this took place while I was out of communication, so I had no idea it was going on.
I called Amex on the local number where I was, and the agent there was fully able to deal with the situation. It was nice not to have to call the UK about this, and it was a dead easy thing to sort out.
The most interesting thing in the discussion came after I confirmed that there had been fraud and Amex immediately set about dispatching a new card to me. I said that it would be some weeks before I could get that, and what should I do in the meantime if I really needed to use the Amex. (I had in mind the possibility that I might have to buy more tickets from BA.) The answer was that I could call Amex in advance so that they could unblock the "cancelled" card for the specific transaction I needed to make. That was a useful safety net, although I didn't in the end need it and the new card was waiting for me as promised.
I also managed accidentally to charge the Amex for a foreign phone top-up, because that company had stored the card number. That went through as well, although clearly I will have to pay for that one!