Doh! How embarrassing, so there I was looking at my Amex card again, and re-reading the instructions from Apple, and I realised my mistake.
On the back of the card, there is indeed a 3-digit code that looks for all the world like a security code. Except of course on Amex cards the code is printed on the front, not the back. And of course on the front, there it was, my 4-digit code. I did write back to iTunes support to apologise.