steffie... sorry to hear, we've had some of these ass-hats pull this shit w/ our sites as well (we too use ccBill). now, ccBill isn't at fault here, these aren't 'refunds' of any sort, your user is just a thief. since you said this has happened twice now (3 months once, 12 months now) go ahead and look through the ccBill stats system and examine the IP addresses this thief originates from each time... if they are similar, block his entire IP subnet via .htaccess from your join pages, so he'd be forced to go through a different ISP (or proxy, but most common thieves don't know anything about proxies!). also, keep an eye on your joins, and if you see this guy return, just refund him and block him. again, real sorry to hear you got scammed this hard, the worst we ever had happen was someone called ccBill for a refund on a 4 month subscription, which of course was granted w/out argument, and *then* they did a chargeback through their bank! so we actually lost the amount from our ccBill account... fucking thieving surfers..!
