I would worry about the third-party aspect of the second reservation. Surely the hotel can tell you which third-party made the reservation. Do you use this third-party channel? Was the third-party reservation in your name or did it just use your credit card number? Also, aren't most third-party reservations prepaid? Could it be that an insider was testing your credit card number with the intention of making more charges on your account?