Another comment actually says that he managed to create a virtual credit card, change the payment method, and delete the card. Quite clever. It's a shame that methods like this have to be used instead of just the click of a button.
Report the transactions as fraudulent, they'll soon stop.
I learned that you can request a replacement card with the same number, which I was initially very excited about. But when you get the new card it has a different expiration date, so it still needs to be updated most places.
On top of that it wasn't even activated because we'd stopped using Citibank to simplify our accounting and just hadn't cancelled entirely yet. Backdoors exist apparently for recurring charges that roll over onto new cards for "customer convenience" because you wouldn't want to miss your bills and lose access to Netflix.
"Hi, these are unauthorised, fraudulent transactions, please revert them and block future charges from that merchant"
That's all it takes with Amex and most others AFAICT.