Possible defeat of a delivery agent's three-way verification system - supplier at fault ?

SalveForOldSores

Out of four items in a recent order placed with a prestigous wine supplier (By appointment to HMQ) , all of which were to be delivered to third parties for Xmas. The suppliers chosen delivery agent was DPD (There was no choice).
Some rather odd things happened . 
No 1: One of the items became a missed delivery and the delivery agents E-Mail for re-directing it elsewhere ended up in my E-mail box, rather than the consignee !  The consignee is 200 miles + remote from me. I think this happened because whilst  the suppliers order entry process had the facility to record on the order the third-party consignee's postal address, there was no facility for recording their E-mail address. So if the information isn't collected by the supplier at order time, it can't be passed to the delivery agent.

No 2: At the time I didn't think too deeply about it, I thought  it was a new revised process, so that  after consulting  trusted near relatives local to  the consignee (The later was unavailable to contact due to working patterns), I replied to the E-mail and re-directed the package to one of DPD's Pick-up shops.
Next day  I received an E-mail notification confirming that the package was ready for collection  from a shop.This E-mail included the shops address, the delivery history and parcel number, the name and address of the consignee and a QR code which needed to be proferred, presumably  along with photo ID and a utility bill or such like. (Three-way verification. So again, I, as the consignor,  was required to forward this information to the consignee so that collection of the parcel could be made.

No 3. I fowarded the delivery agent's E-mail to the spouse of the consignee  and copied in the trusted relative. Then the trusted relative contacted me and pointed out that a name on the QR code label was not the same as the consignees. So I said I'd contact the supplier. They weren't certain what was going on and so, on my request, contacted DPD, who later advised by E-mail that collection could be made on presentation of photo ID and a utility bill (No mention was made of the QR code).

No. 4. In the meantime the trusted relative texted me to the effect that the consignee had collected the package, but on checking the DPD site I find that a fourth part, with a lower-half head shot I don't recognise,  has collected it . . . . . presumably without the use of the QR code which is part of the three way verification system.

What an absolute pants system. Seems that operators  down the line are actively working round a deficient system and compromising security.

Needless to say I've reported the informational deficiency on the Supplier's part to same.

Just as well it wasn't anything too valuable.