They dont offer a Latter of Guarantee, so there is no way we can say 100% for sure that the first address is theirs. So, I assume you are 100% that the first address (3Fz3...) came from their website, right? Did you double check the address you copy/pasted when sending the transaction?
Yes, I'm pretty sure that the address I use is exactly the same address shown on the page.
I scanned the qrcode when sending the transaction, and I double checked the address in the qrcode.
The address in the qrcode and the address on the website is exactly the same.
https://www.blockchain.com/btc/tx/d1b4919df80249136388b0e17d106c5d51ae7f7075223f5f973e4dc5749d7be0The deposit UTXO has been spend after 27 confirmations. That indicates that they do have the private key of the address.