Ok first of all relax.
Next. Threats of court, CCJ's, etc are all standard Debt Collectors template letters designed to frighten you.
Now you've found CAG you're well on the way to dealing with them properly.
Ok 2004, then it's likely the CCA will be unenforceable, so get the CCA request sent off as soon as you can and see what they come back with.
Next, don't call them. They'll always bluff, lie, and intimidate, to try and scare you. They appear to be unprofessional, as that is what they are. They employ life's failures on minimum wage and promise bonuses if they hit targets. If they call you, refuse to answer their so called security questions. If they ask why, say, "Have you not heard of identy theft?" and hang up.
Once you have a reply to your CCA request, scan it, remove personal details, and post it on here and the experts will take a look at it and tell you if it's enforceable or not.
Also, as it's now with AIC I take it you would have got a "Default Notice" from Natwest? If you have it, scan that, remove personal details, but leave dates intact. As not only can a CCA be unenforceable, but a Default Notice can also be invalid. Both of which you can use as ammo against them.