Sounds like he took your name and supporters number off your card, phoned up and pretended to be you, paid for them and sent them elsewhere. In the past I cant think of city carrying out any real security checks over the phone other than to confirm your name, DOB and address which can also be available if the friend knows you well or through some sort of social media. The worse case is that person could phone up and "cancel" your ST, purchase hundreds of ££ of random tickets, change or gain your bank details or come up with some creative ways to mess you around. Data protection at its best.
I think with city you can act on behalf of others (in my case for my father) but where does that line be drawn. Again, it has been widely documented the shambles that can be city box office or city on the phones.