Others might have better or different ideas but when I see companies behaving like this I love to prod them and get them to pay attention... and make work for them...
Since they are quoting the NRCoT I'd be writing back to them.... Point out that there assertion that you must have the ticket for the journey is not always the case - point out the relevant section of the NRCoT, vis 6.1
Point out that you fall into two of these conditions....
6.1. You must have a valid Ticket to travel before you board a train where there was the opportunity to buy one unless one of the following circumstances applies:
6.1.1. At the station where you start your journey, there is no means of purchasing a Ticket, either because there is no Ticket office open or self-service Ticket machine in working order; and where notices indicate that you are in a Penalty Fares area you purchase a Permit to Travel if there is a working Permit to Travel issuing machine at the station where you start your journey – see Condition 10 for more information about Penalty Fares; or
6.1.2. Where you are specifically permitted to board a train service by an authorised member of staff or notice of the Train Company whose service you intend to board;
As such there is no case to answer. If there is a file on your names then you require to know why this is being held . Remind them of the GDPR and the processing requirements such that (Article 5(1) ) data is....
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes (‘purpose limitation’);
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
I'd ask them that since you have done thing other than comply with the contracted terms, that you have not broken any bylaws, and are no different from any other passenger in that regard you data is being processed differently.
You also wish to make a full subject access request and expect that to be returned immediately (they have to do it promptly they cannot wait for the maximum time period - remind them of that).
Then suggest to them that if they remove the warning, confirm in writing it has been done and ask them to suggest a suitable recompense for your time....