Unauthorized Porn Charged to My Account

Today I got an email from " [Edited: "Personal Information"]".
Here is a cut and paste of the essence of the service order:

"Your updated service order is confirmed."

"PENTHOUSE $19.99  
HUSTLER On Demand $19.99  
Cinemax $12.00"

I never made any changes to my account, and the only one authorized to make changes such as odering a movie or adding features, is me, Boris.  And I've not even ever done that.

When I finally managed to get out of robot menu [Edited: "Language"], and got a live person, Shylo (or Shilo?) cancelled the charges.  Shylo told me that my account showed that the only persons authorized to make changes were Boris Mylastname, and Ruth Mylastname.  Huh?  There is no Ruth Mylastname.  Someone, somehow, was able to add Ruth Mylastname.

Now, the Comcast account is for my second home, which I rent out for short term rentals through AirB&B and VRBO.  The home currently has renters for three days, and the charge began the day after they checked in.  They are lawyers celebrating passing the bar.  They do know my first and lastname, but that's all.

Not only did Shylo cancel the charges, She also took "Ruth" off the authorized list, such that only Boris Mylastname was again the only person authorized to make changes to the account.

I still wonder about two things:

1) In order to accomplish what was done, the 'thief' has to act as Boris and authorize "Ruth" to make changes.  To prove you're Boris, you have to know Boris's last four S.S. digits, or something only Boris would know.

2) Even though Shylo said she'd change the account authorizations back to where only Boris could make changes, seems like the same person could just do it again, if they have Boris's 'information', whatever that is.

I did call the renters before I called Comcast, and told them of the charges, and asked did they know anything about it.  So far, they have not called back.

I also had the TVs in the home locked with a PIN prohibiting changes with Comcast.

Any idea how this happened?  The renters?  Not the renters, but someone else who hacked in?  It is awful coincidental.  Perhaps the renters called Comcast and said, "I'm Boris Mylastname, and I want to authorize my wife/sister/daughter Ruth Mylastname to make changes to my account, and Comcast was lazy about asking for proof it was me, Boris, authorizing "Ruth".  They do know my full name (maybe more?)

BTW, I have no social media accounts, none.

I'm afraid this may happen again by the same culprits.

Comments and ideas are appreciated.

TIA