Cancel the credit card and get a new one and try to change the Xbox Live password from the email registered to the account.

Kou wrote You should call the police about this as it is fraud, they will be able to find the person doing this and arrest them. They could also get your money refunded as well.

Interesting thought. It would be good if this could lead to a breakthrough.
I will strictly advise you and your girlfriend to contact the bank and immediately block any transactions associated with Xbox etc. If that does not help, then request the bank to completely terminate the card

Make Sure You Talk To Your Bank And Tell Them That There Were Charges On your Card That You Did Not Make , They Should Give You Your Money Back. Hope This Helped

definitely call Microsoft, they'll get all of your account info back to you, and they will console ban him, and the bank will give your money