Theives who run unauthorised transactions

If I could give zero stars, I would. My husband attempted to book a room using his credit card. He recieved an email stating that the card had failed, so the booking was cancelled. He thus considered the booking cancelled, and did not check his email further (it's an account he very rarely uses). Without his permission, Agoda ran his card again, and this time it worked. They made a booking without his permission - sent an email, and he missed it, because he rarely uses that address. Our bank did a chargeback, but Agoda's bank charged again, and now our bank has failed us as they say they can't chargeback again. Agoda is saying we used the service, we absolutely did not - we didn't even know about it. We called them and they refused to budge, which is when we called our bank in. They are disgusting, dishonest, and nefarious.