If I had to guess between some random bug nobody seems to have reported before that just so happens to give a huge amount of tokens or a kid somehow sneakily finding a way to use daddy's creditcard...then yes, my guess is on the latter.
But hey...if its a bug...well, uhm...im sure he'll be grateful for you reporting it