Forgot to mention, I also created some virtual cards with low limits for someone from my team (I run a software development company) to test payments in production.
So they would make a payment and then refund it etc. - I think they may also have accidentally chosen the refund reason "fraud" for one of the refunds.
That probably wasn't a smart idea either since they were making charges from a Ukranian IP address...