hollunder: I wrote this to the support already and was directed here. I guess it does not hurt to say this again:
You should never ever make purchases for a user.
At the time of the "purchase" of the OST I was not even logged in.
I know it did not cost me anything and the way I pay you could not even bill me anything on your own but it still feels very very wrong when you read that you have made a purchase when you have not.
My reaction was roughly:
Was my account hacked? Unlikely, but what the hell is going on? Is there a news item about it? No. When was this purchase made? I was not even logged in then, I could not even have done it by accident. It is "free", so more likely GOG made that "purchase" for me for some reason.
Seriously, don't do that.
Ditto. Didn't see it on the news, but checked here before asking GOG directly about it. Luckily the post was on the top of the list when I did. I thought receiving something for free was a glitch more than a hack though, but the email's title did turn on my "uh oh" alarm.