The complication you have is that you have admitted to previous instances of fare evasion, so you have rather made their case for them.
As you say, there is a six month time limit for prosecutions for the most likely offences they could allege - a breach of Railway Byelaw 18 (entering a train without a valid ticket) or the Regulation of Railways Act 1889, RoRA (travelling beyond your ticket's destination, or ticketless travel with intent to avoid payment).
However there is no time limit if they were to bring a prosecution for an offence under the Fraud Act. That includes not just the "usual" fraud offence you might think of (fraud by false representation - a tricky offence for them to prove for 'mere' fare evasion as opposed to falsifying tickets etc.) but also obtaining services dishonestly, which they may find slightly easier to prove.
It's unlikely that Chiltern would bring a Fraud Act prosecution in their own right, as it is much more complex than their usual 'sausage factory' of prosecutions under the Byelaws or RoRA. However they could (threaten to) pass the matter to the British Transport Police, who might decide to investigate and in turn pass the case to the Crown Prosecution Service if they believe there is sufficient evidence to charge you,.
From a civil perspective, they might decide to bring a claim based on civil damages for one of the above-mentioned offences, though in the absence of a conviction that will make their case harder. It would be much simpler for them to claim based on the National Rail Conditions of Travel (NRCoT), which purport to give them the right to charge you the undiscounted Anytime single for each ticketless journey. I say 'purport', because such a clause could be considered a contractual penalty, since it ignores the availability of return, Off-Peak or Railcard discounted fares, and thus may cost you far more than you would reasonably expect.
For a contractual penalty clause to be enforceable, especially in a consumer contract, it has to be drawn to the attention of the consumer. I would doubt that hiding such a clause 9 pages into a 34 page document - which no reasonable person would tend to read - would meet that requirement. Moreover, there could be an argument made that condition 9.2 (the condition that sets this rule out) should be interpreted literally and hence the following section (bolding/underlining mine) should mean they have the right to
either charge you the Anytime single
or to take your details for prosecution, but not both:
9.2 If you are unable to present a valid Ticket when asked and the conditions set out in Condition 6 do not apply, we are permitted in law to take one of the following measures:
9.2.1 To charge you the full undiscounted “anytime” single fare to a station directly served by the train that you are on. You will not be entitled to any discounts or special terms, or to a Ticket to a station other than one served by the train that you are on; or
9.2.2 To charge you a Penalty Fare on certain trains and stations (see Condition 10 below); or
9.2.3 To report you for prosecution.
Finally, in any civil claim they would struggle to recover the 'administration' fees they usually add onto any out of Court settlement (in lieu of prosecution). There is no contractual or statutory basis for claiming them so they are purely reliant on common law (i.e. legal precedents), which do not exactly go in their favour. For example, when supermarkets tried suing shoplifters for costs towards security staffing, the courts rejected this as there was no legal basis for this - the argument being that the security costs would have been incurred whether the individual had shoplifted or not. I think the same argument would apply here - Chiltern incurs the cost of employing barrier staff, RPIs, back office investigators etc. as a deterrent measure - not specifically because of your case.
The Civil Procedure Rules (CPR) set out which costs can be recovered in the event of a civil claim. A claim of this value would almost certainly be allocated to the Small Claims Track (SCT). The costs that can be recovered under the CPR for SCT cases are very limited; essentially just Court fees (which are fairly low), interest (customarily at 8%) and their staff or representative's direct travel costs of attending hearings. They cannot recover more than a very small amount in legal costs (e.g. for solicitors), generally limited at £50 for bringing the claim and between £22-55 if a judgment is entered against you.
Practice Direction 45 tables 2 and 3 set out the details.
If they decide to bring a civil claim, then it is advisable to respond to any Letter Before Claim (or similar), since the Civil Procedure Rules require parties to engage reasonably to avoid Court proceedings where possible. If you don't act reasonably then the CPR do allow them to claim costs for 'unreasonable behaviour' - albeit such applications (whilst frequently made) are not often granted.
Saying something like "I'm willing to pay the difference between what I paid and [the amount 'legitimate' fares would have cost]" would strike me as a reasonable response, even though I'm sure they would want you to pay rather more.
In summary, provided you are willing to accept the small (but not non-existent) risk of a Fraud Act prosecution I would consider refusing to engage in further correspondence for now, only responding if things actually proceed down the civil or criminal tracks.
