unauthorised roblox purchases

We have had a few problems with my son's Roblox user if being changed to lock him out. It's happened again. Now they have created lots of unauthorised Roblox purchases that have come through iTunes. I didn't think our card details were stored in Roblox. Does that mean they have the iTunes password too?

Has any one had this happen to them?