What you did is normal. The charger + and discharge + are common. This BMS schematic is for a 36V pack, and a 48V pack would just have 3 more sets of cells. Still, you may be right about the BMS being the culprit..
It says that the X4 switch is open circuit. You're not really seeing 28 volts on the charge port, just the residual voltage leaking thru the X4 circuits.
The charge circuit is open, if any of the 10 cells groups in the diagram, (13 for a 48 v battery) are (1) below 3.0V or (2) above 4.2V. You mentioned this bike has been in storage at the previous seller, but Rattan is still a newer compancy, so the bike cannot be that old. It's possible (1) was true, but charging thru the output should have fixed that. You may have the other case where (2) is true, and that can happen when you charge thru the output because there's nothing to stop overcharge.
If it were my battery, I'd check the series cell voltages, but most peopel don't know how to do that or want to do that,
If you were to look inside a battery, you can sometimes find the BMS out in the open and its balance connector that carries those balance wires. This is where you would go thru the process of checking all the series voltages. On a few batteries, it's packed inside wuth the cells under shrink wrap and not easily accessed w/o really taking aaprt the battery.,
