Quite a comprehensive write up!
Just one point:
The handling of pre-auths is “by design”: It’s not that someone tries to charge your account, it’s just that monzo takes your money from the account the moment they receive an authorisation request. That’s intentional. It’s come up quite a lot in the past, so search the forum for details, but you may want to read this as a starting point: