Earlier quoted context omitted.
With the number everyone can withdraw money (which is two clicks to cancel the transfer but still annoying).
Source needed. AFAIK that would mean faking a direct debit mandate which would be a criminal offense.
The person above you is right. I've never had it happen to anyone I know so the risk seems exceptionally low (also because of the undo option), but technically you can indeed just fill in any IBAN and get that person to pay for your product. Responding "but that's illegal!" is like wondering why we need police at all; nobody would violate the law right??