The Experian report that American Express cited should show only two card accounts opened in the past 24 months. Have you checked the report to verify that it is accurate? If, for example, your identity has been compromised there could be a flurry of other activity.
American Express would know about a third account (their own Business card). They could infer that you had opened other business accounts from the Inquiries, but if that were the case I would expect them to mention Inquires, rather than Accounts, in the letter.