Same thing happened to us, same day. We're now on the hook for $3,500.
When Twilio PROFITS from known fraud, they have no incentive to stop it even when it's obvious. (In our case, tens of thousands of premium SMSs to the same number within the span of a few hours).
They aren't issuing a refund for us. As an unfunded startup, this is incredibly deflating. We feel robbed, and Twilio should feel ashamed for pocketing a juicy kick-back from the robber for letting them continue their robbery without making a peep.