Yeh just happened to me an hour ago, they only purchased 2500 points (Which is strange, they could have gotten so much more.)

So I removed all payment options from memory and said meh, there is a few games from house party I wanted anyway so I am just going to go ahead and grab them instead of going through the painful process of refunding 40 odd bucks. I don't classify myself as rich but I am single and run my own business, I have the money laying around.

Just a heads up, may not be a good idea to save credit card info on Xbox live anymore, I am probably going to use prepaid cards from now on.

You can always get instant codes, I think Amazon do them. In the UK the online retailer ShopTo will just straight up text you the code for MS Points and XBL Gold.

Looking at it, they used my paypal account that I had saved there. The annoying thing is, I couldn't get it to work when I wanted it too, and somehow they just 'used' it. Ironic IMO

Just a couple of tips to help lock-down your account:

1) Obviously, use a different password for this account than you use for other accounts.

2) Optionally, use a different email address than your normal email for your WLID. You can change your email associated with your WLID account by following the instructions here: http://support.xbox.com/en-US/billing-and-subscriptions/account-management/manage-live-id#a6c524b62efb4ee18beed5705533201e

3) Setup a trusted-pc, as well as additional proofs: http://www.xbox.com/en-US/Live/Account-Security/Security-Checklist

4) Setup a "security question" as a second password.