it is called card banging, unwanted charges, card banging ... maybe your gf users registered when the card banging option was on? otherwise its not possible to take money from credit cards without knowing the owner ...
but yeah maybe we will hear some script error story ...