I think this issue is orthogonal from the one mentioned on the discussion board. My understanding is that the user on the board is complaining about someone stealing his card number and using it to buy stuff on iTunes via the hacker's own account; the OP is complaining about somebody using the OP's iTunes account (and possibly his PayPal account?) to buy things on iTunes.

It sounds to me like the developer of the app purchased might be in on this - there are apparently multiple reviews saying that the same thing happened to other people. Or maybe said hacker(s) just like playing that particular game?

Edit: I completely agree that do_not_reply is the wrong address from which an email like this should be coming.