Twin boys rack op $3,000 worth of charges via the App Store.
"She says the boys were putting in the password and being prompted to make purchases that ranged from 99 cents to $99."
I think we found the problem...
Apple thought they "fixed" this when they prompted for AppleID credentials for every in-app purchase. Little did they know, they can't stop parents from giving their kids the password and let the kids authenticate themselves.
Good luck getting out of this one, Paula.