8.5 years is not a decade. Precision matters, especially when talking about money and time.
Did you verify the actual payment processed by the merchant processor, or just the category it fell in and the price of that category when the domain was actually registered?
Bad code happens, the Google Cloud Print DDoS fiasco is but one example.