Interestingly enough, that's how I've seen other people's accounts hacked: it starts with a tiny, easy to overlook item like a $1 i-Tunes purchase.

Then within a couple of days, they hit the account for real.

Good on Chase for watching for that signature "test buy".