me personally, I am not as worried about SOL. I would initially focus more on the fact that these people are continuing collection efforts after a DV request has been received, without answering that request. This is a plain violation of fdcpa, and I would start there. Hopefully you sent that DV letter via certified mail RRR....so you have proof they got it. If you do, I would send them one more letter, also CMRRR, and tell them that they are in violation of the FDCPA. Threaten to take legal action if they do not immediately cease all collection efforts until they provide proper validation as required by federal law. Oh, and by all means do not use that card they sent--the courts will often consider it tacit acceptance of their proposed settlement terms if you use it, and that will reage the debt.
Then, I would go after the SOL. You cannot really go after SOL effectively until you have the information about the account, because that info will be needed to prove that SOL has expired if you take this to court.
They cannot access your bank account as long as you do not provide them with your banking information, and you should NEVER give a CA that info.