I should have been more suspicious of the iTunes statements. There seemed to be a lot of them.
Eventually I connected with my spouse, and we realized #1 was exploiting an iOS 7 iPhone configuration error. When he inherited my 4S the iTunes account was configured for delayed authentication (the default ). Every time we bought a song or video, he added on a few more. Last year's Stanley Cup series was the giveaway.
When I collared him he pretended not to understand that his purchases cost us money. I respect that. If you have a cognitive disability, you might as well use it to wiggle out of problems. It didn't work though, he knew I knew that he knew how the charges worked. He quickly gave up that alibi.
So we needed consequences. What formula would be most educational, without inducing full rebellion or breakdown? How could we use this to advance his financial skills - and maybe even get some money back?
I needed a balanced formula -- something that had a built-in reward paired with a consequence extending over time. It had to be understandable to him, ideally something visual. After a bit of thought I came up with a formula that worked very well - not least because relatives gave #1 generous iTunes/Amazon gift credits this year.
I created two iTunes Playlists for him - one with the music he'd acquired honestly, the other with his criminal gains.  Each time he wanted a new tune, he had to pay twice. Once for the new tune, and once for an old one. I then "moved" the "stolen" tunes from the Unpaid to Paid list, in addition to putting the new purchase on his phone. We did the same thing for the videos.
After the first few purchases he caught on to how the system worked. He was clearly satisfied -- he likes justice fairly applied. Even, or especially, when it's applied to him. We went through about 1/3 of the backlog with his allowance and snow shoveling money, then a deluge of iTunes/Amazon gifts took out the rest. In an impressive gesture he cleared out the last 15 in one direct purchase.
Effective consequences require creativity; this one worked. I'll look for other opportunities to apply this kind of balanced approach. I know they'll come along.
 For us this was an annoyance, but in some cases the family financial impact could be serious. I wonder if Apple ever reverses charges on appeal... It would be "nice" if Siri could execute "configure this phone for a child".
 I intended to only sync the first to his iPhone, but with iOS 7 there's no way to prevent someone from using WiFi to put purchases music/video onto a phone. I turned the Cloud setting off, but he just turned it back on again. He's learned a lot from his iPhone.