The bad guys are getting better and better at breaking into password protected accounts. Apple's iTunes and App stores are a rather large target, and certain to attract much more attention than most of the other vendors from which you buy things online.
One of the really big problems is the use of easily guessed passwords. People use them because they can remember them, but they make your accounts vulnerable. I know how frustrating it can be to try to get passwords all squared away, but it is important, especially for sites with high profiles, which are going to attract all kinds of attempts to break in. But if you use a guessable password, sooner or later one of the nogoodniks will discover it.
I highly recommend using one of the password managers that make your passwords instantly available on your computer. This allows you to use strong passwords without having to remember them. And it reduces your risk to the theft of your computer or the hacking into it, risks smaller and easier for you to control. This also requires you to make sure your anti-virus software is up to date at all times, not a bad idea in itself.
I don't know how the OPs account was breached, although the odds are somebody guessed his password. But yes, you do need to pay attention to your credit card statements. A couple years ago I found a charge on mine I didn't recognize, and upon investigation found that somebody had somehow managed to charge something to a credit card number I'd had ten years earlier. Of course, that number had been changed/upgraded, but somehow "the system" decided it was still mine, and tried to apply it to my current account. The credit card company was quick to remove it, but only after I called them on it.
It is important for everyone to be vigilant. Your credit card bills, even your phone bill, are all vulnerable to all manner of scams. You need to check each of them every month, and if you see a charge you don't recognize, call them and inquire. You might have forgotten a legit charge, but you might also be saving yourself from a scam. And of course, if you don't nip it in the bud, you can count of the number of fraudulent charges multiplying each month until you do call them.