This is exactly the reason they responded. By changing the code quietly, they would implicate themselves. An official PR statement like this is obligatory.
What is more probable, that they a lying, or that the random generator generated not a single code that matched, which is very(!) improbable by itself, but two codes that belong to the same account, generated at the same iteration.