2) and 3) would probably always be illegal since phone numbers are recycled and you can never know when that happens. I guess it’s fairly likely that is what happened in this case?

So even if you are sure it is the number of a customer, it is verified and used for correspondence it can still be sometime else number a year (I don’t know how long the recycling waiting time is) later.