I had turned off inapp purchases but he still managed apparently by resetting my account password using the Ipad. It's less than a tenner but how do you stop stuff like this from happening in future?