I have already heard the same story here on Namepros before, but i didn't pay attention ( until it happened with me )
I have almost 10 domains + a VPS hosting on Namecheap
5 days ago out of no where i found 2 purchases notifications from my bank that i didn't make using my Namecheap account so...