Ok, complete 100% outside observer here.
THY, it looks like what Chris is saying is that the person has ALL of your info. Epass username, password AND Visa number, expiration date and CVV2 number, your physical address.. everything. (Ouch, that sucks!)
Also, he said that they were all Visa purchases. IE: Someone BOUGHT 4 products/services worth $500 each, draining your $2000. There is no Visa spend limit per day is there? Only an ATM withdraw and P2P limit? That would explain that if so.
Anyway, I say good luck to epass to get those merchant(s) to acknowledge that they were fradulent (before they got to the merchant) transactions, and to allow the charge backs. Maybe a bank rep. could help if they know the amount of funds daily that you're dealing with.