This just happened to me two days ago and I thought I would post my experience here as I am upset and maybe some feedback would help. Someone got access to my xbox live account, logged in from another location, purchased 10,000 microsoft points using the credit card I had on file, and used them to purchase all sorts of random downloadable content. I called and told them my issue, they said they had to open a unauthorized access investigation that would take from 11-14 business days.
The woman I spoke to said she could not refund the transactions because I removed the credit card on file. WHY would I keep the credit card on file if my account was just used by someone not authorized, and charged ~$150.00 to said credit card?!
I am hoping that I can get a refund soon as I can not afford to cover the funds that were withdrawn.