Thieving buggers.
My partner ordered from Lego.com. The parcel was delivered while I was at home. My partner told me there was a parcel coming, but not who it was from.
The parcel DPD delivered was not from Lego.com, it was from Herbalife Nutrition (their branding was all over the box and tape).
There are 2 address labels on the box. On the original address label (for a shop 200 miles away from our address) the barcode has been covered by a strip of black tape to prevent it from scanning. The original delivery address is incomplete (there is a number missing from the postcode). The date on the label shows it has been sitting around in their depot for a week; apparently, they were unable to deliver it because of the incomplete postcode.
The address label showing our address is has been unevenly stuck on the side of the box (the original address label was stuck very neatly on top); it is creased, and the edges are peeling.
There is still a smaller, secondary sticker on the parcel relating to the original delivery address. Both address labels have the parcel weight, the weight on the label with our address is half the weight of the one on the original delivery address (which is also the correct weight).
It seems pretty obvious that somebody working for DPD saw our parcel from Lego, peeled our address label off and then stuck it on an undeliverable parcel they had lying around in the depot, and has helped themselves to our parcel. As far as Lego are concerned, the tracking shows that the parcel has been delivered.