I know there are too many different names involved in using Mixin Safe, but MixPay is a third party app on Mixin Messenger. They issues EPC for you so that you can verify your Mixin Messenger PIN while doing something. So you need to transfer EPC to them to get back the refund. In that procedure you proved that you knew the PIN, otherwise if they just sent back your TRX and you didn't know the PIN at all, then the money is lost.
I haven't tried it, but is there a limited number of PIN attempts and for example what happens after 5 incorrect attempts in a row?
If there is no other recovery method, the app should not lock. Enabling an unlimited number of attempts is again not a good solution from a security point of view.