A developer's API key leaked and ran up $18,000 overnight. Do we refund it, and what do we change so it doesn't happen again?

Make your call first. Use the published answer and rubric to examine your reasoning when you are ready.