This is likely exactly what happened. 
It is worth stating that merchants can technically charge your card for however much they want whenever they want, with or without security details, but that doesn’t always mean they are right to though. 
In this case, they are collecting money you agreed to pay, even if a system refunded it to you because they were slow to do so.