No matter what happened, someone must have provided Digital River with the credit card details.
Could be during buying a paid product in the past that one forgot about, a trial wasn’t stopped in time etc.
Sometimes it is someone at the same household that bought something without telling the partner.