Checking into it further, each order was for £53 - a card plus a giant candle, sent to an address I didn't recognise.
Presumably part of a scam (which I'd heard of somewhat vaguely) where expensive items are delivered to a third party, and then the scammers collect them from there, before selling them on second-hand.
The Moonpig helpline didn't open until 9:30am, but I got straight on it then, they were incredibly helpful, and by 9:35 it was all fixed with both orders being cancelled. Quite impressed with their service.
And it serves me totally right for having a password that I hadn't changed in over a decade. Because I hadn't considered that "that place I order birthday cards from" was a threat.
*They make custom cards and send them out automatically. They also sell candles, flowers, and other gifts. They're really useful for birthdays, etc.
Original post on Dreamwidth - there are comments there.