Twilio Account Hacked

I did try to give VAPI my twilio account to play around. Yesterday I saw unauthorized usage & SMS's for authy was heavily used on my account. I deleted all API keys. Yet my billing kept going higher. Twilio helped me suspend the account. But i am curious an account without any API keys ideally shouldnt have got further misused. what am i missing?