Considering that there is such a simple technical solution (IMEI lock) to this problem and considering the amount the Telco charged for the data in this case, I really think that the punishment here was too harsh.
The power company should at least pay for some of the charges due to not using a simple technical precaution (which, according to the article, they implemented for later customers) and the carrier, well... where I live extortion is a crime in itself and charging 193K for data traffic is just crazy.