Thanks all, yes it looks like i might have been taken for 0.15 BTC in total (still trying to figure out which invoices were bad ones).
This is a big learning experience. It's going to take me a few days to figure out how to harden my systems against this.