What's ridiculous is allowing a 3 year old to play with a $500 gadget unsupervised...
After entering your password to download the app, the password will still be in effect for about 15 minutes. This is a feature of iOS.
This is clearly mentioned in the games description in the AppStore
BEFORE downloading the game. See:
http://itunes.apple.com/gb/app/smurfs-village/id399648212?mt=8
Your child must've 'bought' these add-ons almost immediately after you downloaded the game.
Expensive way to learn a lesson that could so easily have been avoided.