Yes, direct debit. They authorize you account by taking out a minimal amount that you then use as a one-time pin to verify that you are the owner. After that they apparently can do as they please which is not how I thought it was going to work (I expected a verification step from my bank with each payment, a system called iDeal here).
You can (and should!) dispute direct debit. I believe that in most countries you should get a refund no questions asked. Check out the details with your bank.
That's a good one, I wasn't aware of that possibility (nobody ever got it in to their heads to take more than was due). From what I recall direct debit payments can be disputed when they're periodical, and then only for the last transaction, this is not at all like that but I will inquire anyway, because if that works I can resolve this really fast.
It might depend on the country, but I don't think there's one where you hand out your wallet and have no recourse whatsoever against fraudulent withdrawals. My bank (Poland) lets me revert any DD withdrawal through they web interface. The time limit is 30 days (business accounts 5 days only.)