"No worries," I thought, "I have a $30 spend limit setup." When I came back to my desk an hour later, I had $285 in unauthorized charges.
As it turns out, OpenAI will let you create a spend limit _without_ checking "enforce spend limit." If you don't check enforce, it's meaningless. So even though my account showed that I had a $30 spend limit, it still let the hacker blow right past it by hundreds of dollars.
I've submitted a dispute, but wanted to let other people know so it doesn't bite you, too. You can check your spend limits at https://platform.openai.com/settings/organization/limits