I've bought some MIFARE Ultralight stickers from Amazon. All of them have their page 3 set to E1 10 6D 00
My understanding is that I now can't set these 10 bits that are already set, so I've only got 22 bits that can effectively be used in the OTP page now. In fact I tried setting to 0 but it didn't work (which makes sense as the docs state that they will be ORed before writing).
As it happens it doesn't really matter to me for what I want to use them for but I'd like to at least point this out in an Amazon review for anyone else that might want to use the OTP page and buying from this seller.
I'm new to NFC so not sure what to expect but I feel I've been sold a duff product. Can you confirm that I should expect page 3 to be 00 00 00 00?
Thise heavily depends on what you wanted to buy and what you actually received.
If you bought those tags as "MIFARE Ultralight" tags, then you would typically expect that the OTP area is in its factory state (i.e. all zeros).
However, if you bought them as NFC tags (or as NFC Forum Type 2 tags or as NTAG), then the initial content of the OTP erea makes sense to some extent. The value that you found in the OTP area is the Capability Container and indicates that the tag is formatted according to the NFC Forum Type 2 Tag specification (i.e. that it came preformatted as NFC tag). Typically, there will also be some data already written to the next page (probably 03 00 FE 00 in your case). NFC (Forum) tags won't make use of the OTP area as a one-way counter, so there is no problem with having them already set and used as Capability Container.
The problem that I see with the memory content that you described is the data area size indicated in the Capability Container. 0x6D indicates 872 bytes of data memory. This is fine if the tag is not a MIFARE Ultralight tag but an NTAG216, which has exactly that amount of data memory available and always comes in this preformatted state.
However, if the tag is actually a MIFARE Ultralight tag (chip MF0ICU1), then this Capability Container would specify more data memory than the tag actually has. This would render the tag unusable for proper NDEF message handling and, since the OTP bits cannot be cleared, you could not change the indicated size to the value that's actually available (48 bytes = 0x06).
Note: Based on OP's comments, the tags are indeed NTAG216 (bought from www.amazon.co.uk/gp/product/B075RXBVKM). Hence, the memory content is perfectly fine.