I'd be more worried about the individual themselves
You mean the individual whose payment details were used suing the other individual who used them? I think that's even less likely than the other scenario.
Besides which, do we actually have any confirmation that people have been able to purchase games through other people's accounts? I haven't seen anyone claim it besides a couple of people here. Most externals reports detailing the extent of the issue seem to preclude that actually being possible.