Yes, they added a new credit card, and that is the card they paid with. I have been in contact with the host, and they have cancelled the booking, but he actually thought it was a legit booking.
There was also a message having been sent from my account, but I don't understand how that is possible without showing up in the login history...