When you access the App Store via your mobile device, you remain signed in for a 15 minute period. During this time any purchases made do not require you to reenter your password. If you give your device to a child during this time frame, they can continue making purchases. It sounds like your little one is buying in-apps for Racing Penguins.
For more information about In-App Purchases and how to restrict them, see these articles:
iPhone, iPad, and iPod touch: Understanding Restrictions
iTunes Store: About In-App Purchases
You might also want to make sure you sign out of your account, or wait 15 minutes before you let anyone use your device.
That is not true anymore. My son was able to make $100 in charges in the game Pig Run on my phone, buying "boxes of 5000 hearts". He was playing in the morning while I was still in bed, and I know he does not know my iTunes password. They must've changed it at some point, making it more insecure, and I am really really upset.
I just got charged over $50 from Racing Penguins In App Purchases...this should not be allowed. I was under the impression that each charge had to be approved with my password; that is the only reason I let my child use my phone to play the game!!
Apple needs to check these games and developers out before allowing them to charge iTunes customers via their apps.
I'm quite furious!