davidlobsterpot601@hotmail.com declared for all the world to hear...
> Nothing in the text to indicate its source

The source is 89888!

> and I can't track down the
> shortcode anywhere other than ICSTIS.org

Tesco should be able to give you details of the service provider. I
think they are required to be able to do so, although I'm not 100% on
that.

> Tesco reckoned it was perfectly possible for this to have kicked off by
> some so-called friend of my son entering the number on to an iffy
> website. Is that really allowed, without being solicited from the phone
> which is going to be charged?

No,. Opt-in confirmation is required. What is more likely is that one of
your sons mates has nicked the phone for a few seconds and sent a text
to 89888.
--
Regards
Jon