Are you required to credit the member funds if the merchant will not provide credit? Reg E puts the burden on you. You can't transfer this burden to a merchant. In other words, whether you get refunded or not, is of no concern to the regulatory requirement.
Are you required to do anything more to recoup their funds? Could it be that your member didn't actually order the purse? Could it be that someone else in their household placed this order (using the same IP address)? Just because it came from your customer's email & IP address and just because it was delivered to their house, doesn't mean your member actually authorized it. It could have been another family member. What did your member say when the vendor confirmed the email and IP address? Did they remember the authorization or still deny it? If they remembered it, then the transaction was authorized and you're done with Reg E. If they still denied it, it's possible that a family member used their debit card without authority and you still have to comply with Reg E requirements.